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DIRTY BOMB VULNERABILITIES: 
FAKE COMPANIES, FAKE LICENSES, 
REAL CONSEQUENCES 


THURSDAY, JULY 12, 2007 

U.S. Senate, 

Permanent Subcommittee on Investigations, 

OF THE Committee on Homeland Security 
and Governmental Affairs, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 9:03 a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Carl Levin, Chair- 
man of the Subcommittee, presiding. 

Present: Senators Levin, Carper, Akaka, Coleman, Collins, and 
Warner. 

Staff Present: Elise J. Bean, Staff Director and Chief Counsel; 
Madelyn Creedon, Counsel (Sen. Levin, Armed Services); Mary D. 
Robertson, Chief Clerk; Mark L. Greenblatt, Staff Director and 
Chief Counsel to the Minority; Timothy R. Terry, Counsel to the 
Minority; Ruth Perez, Detailee (IRS); Kunaal Sharma, Intern to the 
Minority; Adam Doyle, Law Clerk to the Minority; Rob Strayer and 
Leah Nash (Collins); John Kilvington and Tom Lawler (Carper); 
and Rick Kessler and Jodi Lieberman (Akaka). . 

OPENING STATEMENT OF SENATOR LEVIN 

Senator Levin. Good morning, everybody. I would like to wel- 
come our witnesses this morning from the Government Account- 
ability Office and the Nuclear Regulatory Commission. Senator 
Coleman, this hearing is a continuation of a topic on which you 
have worked diligently — ensuring the protection and control of ma- 
terial that could be used in a so-called dirty bomb. 

The material involved in the GAO sting operation that will be 
the subject of the hearing today is not plutonium or highly en- 
riched uranium, the materials that could be used in a nuclear 
bomb. But the material that is the subject of the hearing is dirty 
bomb material — that is, radioactive material in sealed containers 
used for a variety of medical and industrial purposes that could 
also be put to nefarious purposes. The vulnerabilities that the GAO 
has identified, and that the Nuclear Regulatory Commission has 
acknowledged, are significant. 

Since September 11, 2001, the Nuclear Regulatory Commission 
has rightfully focused its efforts and attention on securing the most 
dangerous quantities of radioactive material — the quantities of ra- 
dioactive material classified as Category 1 and 2 materials. Accord- 

( 1 ) 
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ing to the International Atomic Energy Agency, an individual who 
handled or who was in close proximity to Category 1 and 2 quan- 
tities of material would probably be dead or severely injured in a 
few minutes to a few hours. Category 1 and 2 radioactive materials 
are subject to extraordinarily strict licensing and security require- 
ments. 

Smaller quantities of radioactive materials are classified in three 
additional categories — Categories 3, 4, and 5. An individual who 
handled Category 3 quantities could be permanently injured if he 
or she handled the material for many hours or days, with the possi- 
bility of death if exposure continues for weeks. Category 4 mate- 
rials are unlikely to permanently injure people; and Category 5 
quantities would not permanently injure people at all. 

The ability of the GAO to creatively avoid the NRC restrictions 
on Category 4 materials in this instance by obtaining small 
amounts of materials that could be aggregated into larger quan- 
tities to get to Category 3 quantities of material is troubling, and 
that is what happened in this case. 

The NRC has recognized that the out-of-the-box thinking on 
GAO’s part did deceive current mechanisms to regulate materials. 
I note that one of the recommendations that Commissioner 
McGaffigan has included in his prepared testimony is that the 
NRC will “evaluate how to probe for other thus far undiscovered 
vulnerabilities in NRC and Agreement State materials licensing 
programs.” That is an important approach, a good way to try to an- 
ticipate problems in advance, and the result of this inquiry. It is 
also a positive note that the vulnerability that GAO has identified 
has resulted in prompt reaction by the NRC and that the NRC took 
steps to address the problem identified. 

I look forward to hearing from the GAO about the full scope of 
the vulnerabilities, the ways in which NRC is responding, and 
what more needs to be done. Senator Coleman, I commend you and 
your staff for the persistence that you have shown in this matter. 
As I know Senator Coleman and Senator Collins are aware, the de- 
fense authorization bill is on the floor, and as the manager of that 
bill, I will have to return to my floor duties fairly soon, so I am 
going to miss most of this hearing. I regret that I will miss it be- 
cause it is an important hearing. Then that responsibility will be 
turned over either to a Democrat, if there is one here, if not, it will 
be turned over to Senator Coleman. 

We have two Ranking Members here this morning. I am not sure 
which Ranking Member has preference — the Subcommittee Rank- 
ing — 

Senator Collins. Subcommittee. 

Senator Levin. Subcommittee, all right. In that case. Senator 
Coleman, it is your time. 

OPENING STATEMENT OF SENATOR COLEMAN 

Senator Coleman. Thank you, Mr. Chairman, and thank you. 
Ranking Member Collins. 

Today’s hearing provides a sober reality check. We turn our 
attention to the threat of a dirty bomb attack and whether our gov- 
ernment’s efforts to prevent such a disaster are effective. This Sub- 
committee has been engaged in a 4-year effort to bolster the U.S. 
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Government’s ability to prevent a nuclear or radiological attack on 
U.S. interests. The Subcommittee’s efforts have been thoroughly bi- 
partisan, and I appreciate Senator Levin’s continued dedication to 
this cause. 

Make no mistake: The threat of a dirty bomb attack is real. The 
executive director of the 9/11 Commission stated in 2004 that al- 
Qaeda “remains interested in using a radiological dispersal device 
or ‘dirty bomb.’” Even worse, he said that “[djocuments found in 
al-Qaeda facilities contain accurate information on the usage and 
impact of such weapons.” 

The aspiring terrorists that were arrested in London in August 
2004 sought to construct “a crude radiological dirty bomb.” In Sep- 
tember 2006, the then-leader of al-Qaeda in Iraq reportedly called 
for “nuclear scientists and explosive experts” to help his terrorist 
group manufacture “unconventional weapons,” specifically includ- 
ing dirty bombs. Sadly, these are just a handful of examples to get 
a sense of the problem. 

In light of this threat, government oversight of radioactive mate- 
rials has become more important than ever. The best way to pre- 
vent a dirty bomb attack is to stop terrorists from getting radio- 
logical materials in the first place. Our hearing today — along with 
the Subcommittee’s staff report ^ — will explore some gaps in the 
Federal Government’s regulation of radiological materials. In par- 
ticular, we will address weaknesses in the Nuclear Regulatory 
Commission’s administration of licenses for radiological materials. 

As part of its ongoing investigation into homeland security mat- 
ters, the Subcommittee requested that the Government Account- 
ability Office conduct a clandestine operation to determine whether 
a terrorist could use a phony company to slip under the radar and 
get a valid radiological license in his quest for a dirty bomb. The 
results are not encouraging. 

In short, GAO created two dummy corporations and applied for 
radiological licenses — one in West Virginia, where the NRC regu- 
lates radiological materials, and one in Maryland, a so-called 
Agreement State that regulates radiological materials on its own. 
Shortly after receiving the application, regulators in Maryland em- 
barked on a 7-month review process, requesting a site inspection 
of the company’s facilities and interviews with its employees. GAO, 
knowing that this robust review process would expose their sting 
operation, withdrew the Maryland application. That is the good 
news. 

The bad news is that the application that went to the NRC was 
approved in short order. The NRC conducted a cursory review and 
gave a license to GAO’s phony company in just 28 days. 

As if that were not bad enough, GAO was able to counterfeit the 
NRC license — using ordinary computer software that any teenager 
could use — to remove the restrictions on the amount of radiological 
materials permitted under the license. In this exhibit,^ you can see 
the comparison of the valid NRC license on the left and the coun- 
terfeited version on the right, and essentially what you see is a 


^The See Exhibit No. 1, which appears in the Appendix on page 75. 
2 Exhibit No. 2 appears in the Appendix on page 100. 
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change in the restrictions on the amount of radiological materials 
that were permitted under the license. 

GAO investigators then used copies of the counterfeited license 
to execute contracts to buy enough radiological materials to meet 
the NEC’s definition of a “dangerous” quantity — enough, according 
to GAO, to build a dirty bomb. Perhaps more importantly, inves- 
tigators could have easily prolonged their effort, generating dozens 
of fake licenses, visiting multiple suppliers, and stockpiling signifi- 
cantly higher amounts of this — and possibly other, more radio- 
active — material. The GAO states that it could have purchased 
“substantially more radioactive source material” — potentially 
enough to reach the NEC’s threshold of a “very dangerous” mate- 
rial. In other words, the modest amount of radiological materials 
that GAO sought to purchase was but a demonstration amount. 
There is no doubt — and I think the testimony will demonstrate — 
that they felt that they could have continued to counterfeit, contin- 
ued to search out suppliers, and acquired an even larger quantity 
of radiological material. 

These weaknesses are not new. In fact, as detailed in the Sub- 
committee’s staff report, several entities — including the GAO, the 
NEC Inspector General, and this Subcommittee — have recom- 
mended over the past few years that the NEC improve its licensing 
procedures to ensure that radiological materials will be used as in- 
tended. 

To its credit, the NEC has shown a willingness to strengthen its 
licensing process. It made some changes in June 2007 in response 
to the GAO’s latest clandestine operation. Those changes are steps 
in the right direction — and I applaud the NEC for taking them — 
but I don’t think they go far enough. 

I am still concerned that the NEC does not fully appreciate the 
dirty bomb threat. They appear to be focused on the accident in- 
stead of the crime, on safety instead of security, on the good-faith 
actor in a world of bad-faith people. To be fair, focusing on health 
and safety is obviously a paramount concern, and the NEC should 
be commended for its responsible management of the most lethal 
radiological materials. But in this world of sleeper cells and suicide 
bombers, we must also be vigilant about the smaller-scale threat. 

For instance, we think the NEC should regulate so-called Cat- 
egory 3 sources more stringently. Category 3 refers to the NEC’s 
scale for radioactive sources, which goes from Category 1 through 
5, with Category 1 being the most dangerous radiological source 
amounts and Category 5 the least. I think the Chairman laid this 
out in his opening statement. Category 3 sources are in the middle 
range and are designated as “dangerous.” 

Under the NEC’s previous rules, license reviewers were not re- 
quired to visit the facilities of applicants seeking Category 3 
sources before issuing the license. Instead, the NEC would visit 
those facilities up to one year after the license was issued. 

Thankfully, the NEC changed some of its rules soon after GAO’s 
latest operation. While I applaud the NEC’s prompt response and 
recognize that this is a step in the right direction, I believe that 
their change does not go far enough. Although license reviewers are 
now required to visit with applicants seeking Category 3 licenses, 
that “visit” can be a simple meeting at the NEC’s offices. So the 
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problem is clear: Even with this recent change in procedures, the 
NRC license reviewers are still not required to visit facilities of ap- 
plicants seeking Category 3 sources before issuing a license. I be- 
lieve the NRC should require on-site visits — which Maryland ap- 
parently requires — not meetings at the NRC — before Category 3 li- 
censes are issued. 

In addition, the NRC should evaluate whether to include Cat- 
egory 3 sources in the proposed National Source Tracking System, 
which will be designed to monitor the most lethal sources from cra- 
dle to grave. 

The NRC should also take steps to ensure that source materials 
can be obtained only in authorized amounts by legitimate users. 
For instance, the NRC should consider establishing a web-based li- 
censing system so that suppliers can go online and check first, that 
a purchaser’s license is actually valid and second, how much radio- 
logical material the purchaser is authorized to obtain. 

These recommendations are designed to bolster our government’s 
efforts to prevent a radiological attack in the United States. It is 
clear that terrorists are interested in using a dirty bomb to wreak 
havoc in this country. In the words of one homeland security ex- 
pert, the impact of such an attack — even a relatively simple and 
small dirty bomb — could be a “nightmare scenario.” 

The issue here is not the amount of lives that would be lost in 
the explosion itself, or even the amount of radiological material. It 
is the psychological and the economic impact of having radioactive 
material thrown about perhaps in a place like Wall Street or in the 
halls of Congress, and the impact that would have, the long- 
standing economic and psychological impact that would have. 

One critical step is to prevent America’s enemies from acquiring 
radioactive materials in the first place. To that end, the NRC 
should focus on ensuring that such materials can be obtained only 
in authorized amounts by legitimate users. These measures will 
help ensure that the “nightmare scenario” of a dirty bomb never oc- 
curs. 

I look forward to hearing the testimony from the GAO and Com- 
missioner McGaffigan from the NRC today. I know the Commis- 
sioner is passionate about the NRC, and I commend his long tenure 
in government service. I look forward to discussing with him how 
we can work together to better protect America. 

Thank you, Mr. Chairman. 

Senator Levin. Thank you. Senator Coleman. Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator Collins. Thank you, Mr. Chairman. Let me start by 
commending you, Mr. Chairman, and Senator Coleman for your 
work on this very important investigation. 

Since the terrorist attacks of September 11, 2001, I have had the 
privilege of working with the Members of this Subcommittee, par- 
ticularly Senator Coleman, on bipartisan measures to strengthen 
security at our borders and at our seaports. We have made some 
real progress in preventing terrorists, explosives, biological and 
chemical weapons, and radioactive materials from penetrating our 
defenses. Those gains will avail us little, however, if homegrown 
terrorists can readily acquire deadly materials within our borders 
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to fuel their attacks. The enterprising work of the GAO investiga- 
tors suggests that they could do exactly that with relative ease. 

The threat of a “dirty bomb” seeded with radioactive materials 
is widely recognized. The former head of Britain’s intelligence serv- 
ice has said it is “only a matter of time” before a dirty bomb attack 
strikes a country in the West. But we are not the only people feel- 
ing threatened: The Chinese Government has included a dirty 
bomb drill in its security planning for the 2008 Olympics. The con- 
sequences, as my colleagues have indicated, could be dire. 

A 2004 study published by the National Defense University con- 
cludes that a dirty bomb attack “is apt to cause mass panic and 
great economic damage,” even if it is unlikely to cause widespread 
fatalities. A new Canadian Government study concludes that ex- 
ploding even a small dirty bomb in Ottawa could cause over $20 
billion in economic disruption, in addition to localized death and 
destruction. 

If it is indeed a relatively simple matter to obtain, alter, or coun- 
terfeit Nuclear Regulatory Commission licenses to acquire radio- 
active materials, then we face yet another challenge to achieving 
homeland security for our people. 

The GAO deserves great credit for giving us concrete evidence of 
this vulnerability, and, again, I want to comment Senator Coleman 
and Senator Levin for pursuing this investigation. This morning 
many of us woke up to the report talking about a possible diversion 
of an airplane. It is a useful reminder that indeed everything has 
changed since September 11, and this Subcommittee, I know, will 
continue its work to identify vulnerabilities and propose reforms to 
increase the chances of yet another attack. Thank you, Mr. Chair- 
man. 

Senator Levin. Thank you. Senator Collins. Senator Akaka. 

OPENING STATEMENT OF SENATOR AKAKA 

Senator Akaka. Thank you, Mr. Chairman. I want to thank you 
for holding this timely and very important hearing. Despite the nu- 
merous measures designed to tighten domestic and international 
control over the last several years, high-risk radioactive sources are 
still vulnerable to theft and misuse. 

For the sake of bringing back some history of the work of this 
Subcommittee, I want to go back to the year 2000. I have been con- 
cerned about this threat for several years now, and as Ranking 
Member of the International Security Subcommittee at that time, 
I expressed my concern that we needed to be better prepared to re- 
spond to terrorist attacks. And this was in the year 2000. This led 
me in early 2002 to request that the Government Accountability 
Office investigate domestic and international control of radioactive 
sources, including the Nuclear Regulatory Commission’s licensing 
and control of radioactive sources. 

In an August 2003 report to me, GAO stated that the NRC did 
not know the precise number of sealed sources in use in the United 
States, that NRC had difficulty in accounting for generally licensed 
devices containing sources, and that the security of those devices 
varied at the State level. 

As a result, I introduced legislation in 2003 to safely and se- 
curely dispose of low-level radioactive waste. This finally became 
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law in the Energy Policy Act of 2005. The fact is that my legisla- 
tion should not have heen necessary. The NRC and the Department 
of Energy should have solved this problem. But, unfortunately, my 
legislation wasn’t enough. 

GAO testified in front of the Permanent Subcommittee on Inves- 
tigations 3 years later that more work needed to be done. On 
March 28, 2006, Gregory Kutz, Managing Director of Forensic Au- 
dits and Special Investigations at GAO, one of our witnesses here 
today, stated that undercover GAO investigators were able to buy 
radioactive sources using a fake company and were able to trans- 
port the material into the United States using falsified NRC docu- 
ments modeled after those they found on the Internet. 

The results of GAO’s most recent sting operation indicate that 
these vulnerabilities in the licensing process still exist. Clearly, 
more work still needs to be done if we are going to prevent a dirty 
bomb attack on U.S. soil. The critical first step in that process 
must be to ensure strong regulatory control over the material used 
to make such a bomb. 

If we are to believe the March 10, 2007, statement of captured 
al-Qaeda operative Khalid Sheikh Mohammad, in which he told a 
U.S. military tribunal that he was, “directly in charge ... of man- 
aging and following up on dirty bomb operations on American soil,” 
then the risk of a dirty bomb attack by terrorists remains very real. 
We cannot allow the NRC licensing system to continue to fail, as 
it did during the two GAO undercover operations. 

In closing, I would like to remind this Subcommittee of another 
al-Qaeda operative, Dhiren Barot, who told a British court in May 
about his plans to attack the United States and the United 
Kingdon using a dirty bomb comprised of, and I am quoting, “a few 
grams of cobalt-60 with several pounds of explosives . . . enough 
to close off an area the size of Manhattan.” These words are 
chilling, but they remind us that we must remain vigilant. 

Mr. Chairman, I would once again like to thank you and Ranking 
Member Coleman for organizing this hearing, and I look forward 
to discussing what steps we can take to ensure that a dirty bomb 
attack on U.S. soil never happens. Thank you, Mr. Chairman. 

Senator Levin. Thank you very much. Senator Akaka, and thank 
you for your longstanding efforts in this area. They have made a 
notable contribution, and much of the work which you have just 
discussed is an important background for the work that will be dis- 
cussed today. 

Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. Thanks, Mr. Chairman. Thanks for bringing us 
together today. Welcome to our witnesses and colleagues. 

The Nuclear Regulatory Commission has a monumental respon- 
sibility, and I can say with confidence that I believe they fulfill that 
responsibility admirably in most cases. 

When I was Governor of Delaware, I oftentimes said to my cabi- 
net — I still say it to my staff here — “If it isn’t perfect, make it bet- 
ter.” 
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When it comes to regulating the nuclear industry — from con- 
struction gauges to nuclear power plants — the NRC has to be per- 
fect, or as close to perfect as they can be. 

As Chair of the Clean Air and Nuclear Safety Subcommittee, 
part of the Environment and Public Works Committee, oversight of 
the NRC is one of my top priorities. It is a priority that I share 
with Senator George Voinovich, who is the Ranking Member of 
that Subcommittee. In that capacity, we have closely monitored the 
NRC’s efforts to gear up for a renaissance in new nuclear power, 
and I have often warned the NRC that they cannot lose sight of 
their current responsibilities while preparing to deal with the enor- 
mous task of licensing a new fleet of nuclear power plants. 

When the NRC fails as significantly as they appear to have failed 
in this instance, it shakes the public’s confidence. I believe safe, re- 
liable, new nuclear power is one of the keys to our Nation’s energy 
security and climate change concerns. However, a lack of public 
confidence in the NRC will undermine that opportunity before it 
even begins. 

This incident, coupled with the nuclear fuel spill last year, which 
was inexplicably kept from Congress for over a year, cannot be ig- 
nored nor simply brushed aside as small events that we hope will 
not happen again, because this is not just about public confidence 
in the Nuclear Regulatory Commission and nuclear power. This is 
about public safety. 

When I think about this episode, what is most distressing to me 
is the fact that we should have known better. Experts have been 
warning us for years now about the impact a dirty bomb exploding 
in an American city could have. There could be loss of life, of 
course, but the long-term impact such an incident would have on 
the economic and physical health of the community that was tar- 
geted are likely immeasurable. 

The psychological impact a dirty bomb explosion would have not 
only on the community that was hit but on the Nation as a whole 
cannot be discounted either. We can open the paper and turn on 
the news every day and see the impact conventional explosives 
placed in a backpack or in the trunk of a car have had in commu- 
nities like Great Britain, Spain, Israel, and Iraq. Just imagine 
what would happen if those explosives were coupled with radio- 
logical materials. 

The fact is that a dirty bomb is likely the worst terrorist threat 
we face as a Nation today, and one of our major lines of defense 
against them did not hold up when tested. Luckily, this test was 
not a real test and, hopefully, we can learn from the mistakes that 
were made. 

The sin is not in making mistakes. The sin is not learning from 
those mistakes. A big mistake has been made here, I believe. We 
have got to learn from it. Thank you, Mr. Chairman. 

Senator Levin. Thank you. Senator Carper. 

We now welcome our first panel to the hearing this morning from 
the Government Accountability Office. We have Eugene Aloise, Di- 
rector of the Nuclear and Nonproliferation Issues Unit at GAO; 
Gregory Kutz, the Managing Director of the Forensic Audits and 
Special Investigations Unit at GAO; and John Cooney, Assistant 
Director of the Forensic Audits and Special Investigations Unit. 
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Gentlemen, we welcome you, in some cases back to the Sub- 
committee. You have testified here many times before, and so you 
are aware that we have a rule under which all witnesses who tes- 
tify before the Subcommittee are required to be sworn, and I would 
ask you at this time to please stand and raise your right hands. 

Do you swear that the testimony that you are about to give be- 
fore this Subcommittee will be the truth, the whole truth, and 
nothing but the truth, so help you, God? 

Mr. Aloise. I do. 

Mr. Kutz. I do. 

Mr. Cooney. I do. 

Senator Levin. The timing system that we will use today will 
provide that the yellow light comes on 1 minute before your time 
is up. The light will change from green to yellow, which will give 
you an opportunity to conclude your remarks. Your written testi- 
mony will be printed in the record in its entirety. We would appre- 
ciate your limiting your oral testimony to no more than 10 minutes. 

Mr. Kutz, I understand that you are going to be presenting the 
GAO’s statement this morning. Is that correct? 

Mr. Kutz. Yes. 

Senator Levin. Then you may proceed. 

TESTIMONY OF GREGORY D. KUTZ,i MANAGING DIRECTOR, 

FORENSIC AUDITS AND SPECIAL INVESTIGATIONS; EUGENE 

E. ALOISE, DIRECTOR, NATURAL RESOURCES AND ENVIRON- 
MENT; AND JOHN W. COONEY, ASSISTANT DIRECTOR, FO- 
RENSIC AUDITS AND SPECIAL INVESTIGATIONS, U.S. GOV- 
ERNMENT ACCOUNTABILITY OFFICE 

Mr. Kutz. Mr. Chairman and Members of the Subcommittee, 
thank you for the opportunity to discuss our covert test of the NRG 
licensing process. The bottom line of our testimony is that we were 
able to obtain a genuine NRG license using bogus documents. This 
license could have been used to accumulate dangerous amounts of 
radioactive materials. 

Our testimony has two parts: First, our prior recommendation; 
and, second, the results of our covert test. 

First, in August 2003, GAO reported vulnerabilities in the NRG 
licensing process. We recommended that NRC strengthen its proc- 
ess to ensure that sealed sources could not be purchased by those 
with malicious intent. 

As shown on the posterboard timeline, NRC issued new guidance 
over 3 years after our recommendation. At the request of this Sub- 
committee, we performed covert testing of the revised NRC licens- 
ing process. 

Moving on to our second point, our test clearly shows that the 
revised NRC process did not work. Using bogus businesses and doc- 
uments, along with a little social engineering, we were able to ob- 
tain a genuine NRC radioactive materials license. Let me walk you 
through what we did and what we found. 

For this investigation, we incorporated two bogus businesses — 
one in a State where NRC issues licenses, and one in an Agree- 


1 The joint prepared statement of Mr. Kutz, Mr. Aloise, and Mr. Cooney appears in the Appen- 
dix on page 39. 



10 


ment State. Those attempting to purchase radioactive mate- 
rials — 

Senator Levin. Would you stop there? I hate to interrupt you, 
but what is, for everyone’s understanding, an “Agreement State”? 

Mr. Kutz. Those are States that have been delegated licensing 
authority by the NRC to issue radioactive materials licenses. So ei- 
ther NRC issues them or Agreement States will issue them. 

There are 34 of these Agreement States, and as I mentioned, 
they have been delegated the licensing authority from the NRC. 
One of our tests was of the NRC process, and one of our tests was 
of a State process — as Senator Coleman mentioned, the State of 
Maryland. 

In February 2007, using the two bogus businesses and our ficti- 
tious owners and officers, we submitted one application to the NRC 
and one to the Agreement State. As with all of our undercover op- 
erations, we used only publicly available information, hardware, 
and software in making our applications. 

For the NRC application, we received two calls from the NRC re- 
viewer asking for additional information. In both instances, we 
amended our application and faxed the additional information to 
the reviewer. As shown on the posterboard, in March 2007, 28 days 
after making our application, we received our NRC license. 

As shown on the next posterboard, and as Senator Coleman had 
showed, we altered our genuine NRC license to allow for the pur- 
chase of unlimited quantities of radioactive materials. We then 
faxed this altered license to two suppliers who committed to ship- 
ping us numerous machines containing radioactive materials. We 
did not actually buy the machines or radioactive materials, pri- 
marily due to safety and cost considerations. The material that we 
could have acquired from these two suppliers was sufficient to 
reach the International Atomic Energy Agency’s definition of Cat- 
egory 3. Category 3 sources are considered dangerous if not prop- 
erly secured. More importantly, with patience and money, we could 
have accumulated substantially more radioactive material from 
other suppliers. 

To NRC’s credit, and as shown on the posterboard, after we in- 
formed them of our operation in early June 2007, they suspended 
their licensing program. Within a matter of days, they issued sup- 
plemental interim guidance. Although a step in the right direction, 
we continue to believe that this guidance should require a site visit 
before a license is issued. 

For the State application, the reviewer called to inform us that 
a site visit would be required. Since the company office and storage 
facility that we described and showed in our application did not 
exist, we chose at this point to suspend our application. We later 
informed the State that we would not be pursuing our license be- 
cause of financial problems. 

In conclusion, 3 years after reporting NRC process vulner- 
abilities, we were able to beat the system with a basic ruse. Recent 
events in the United Kingdom have reminded us that terrorists 
will use whatever means are available to cause fear and economic 
harm and to kill innocent people. In this challenging environment, 
agencies like the NRC must continue to aggressive and proactively 
assess and address threats. Although we are encouraged by NRC’s 
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recent actions, closing the vulnerabilities discussed today will re- 
quire additional actions and could take years. 

Mr. Chairman, Members of the Subcommittee, this ends our 
statement. Mr. Aloise, Special Agent Cooney, and I look forward to 
your questions. 

Senator Carper [presiding]. Mr. Kutz, thanks very much. I am 
going to ask Senator Coleman, if you would like to lead off with 
questions, and then we will go to Senator Akaka and then to Sen- 
ator Collins, and then I will follow her. 

Senator Coleman. Thank you, Mr. Chairman. 

Senator Carper. You are recognized for 8 minutes. 

Senator Coleman. Mr. Kutz, looking at the timeline there, there 
was apparently a 3-year period from the 2003 report that Senator 
Akaka talked about, which indicated that there were concerns 
raised about the licensing process, and the guidelines issued. Do 
you have any reason why it took 3 years? 

Mr. Kutz. Well, and I would ask other people on the panel to add 
in. I think that they did not take us as seriously the first time as 
they did based on our most recent sting, because in the most recent 
sting they revised their policies within a matter of 12 days. The 
first recommendation, it took over 3 years. So I believe that they 
took this sting more seriously. 

Senator Coleman. Was there any technical problem? I am still 
trying to understand, and they are maybe simply not taking it seri- 
ously, and we will certainly turn to the NRC. Are these complex 
technical issues that had to be reviewed and analyzed for a few 
years before new procedures were put in place? 

Mr. Aloise. Senator, if I might? 

Senator Coleman. Mr. Aloise. 

Mr. Aloise. Senator, there is a lot of what NRC does that we 
agree with, and we have a lot of respect for NRC. We have our dif- 
ferences, too, and this is one of the areas. In our view, NRC has 
not been aggressive enough in licensing and tracking radiological 
sources, the materials that can be used to make dirty bombs. And, 
in fact, one of their executives told us, “We are not good at deter- 
rence in this area.” 

So we believe they need to be more aggressive in this area. We 
have for several years now. It is evidenced by the fact that it took 
them 3 years to develop guidance which we beat in 28 days. 

Senator Coleman. Some would suggest, some might argue that 
this issue was being hyped. How would you respond to that? 

Mr. Aloise. We believe it is a very important issue and it needs 
their attention. Let’s just fix the system that is broken. 

Senator Coleman. Looking at the quantity of materials that you 
were able to counterfeit, how difficult was it to alter the license? 
What kind of procedures did you employ? Is this something that 
would require great technical expertise, or was it a simple process 
they used? 

Mr. Kutz. It was a simple process, basic off-the-shelf hardware 
and software. And, actually, we probably used a more elaborate 
scheme than we needed to because we had to fax the license to the 
suppliers to get the actual shipment. So we could have probably 
just done a basic cut and paste and faxed it, but we actually took 
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the license, scanned it in, and modified those sections, and then 
faxed it to two suppliers, and it looked genuine at that point. 

Senator Coleman. When you faxed it to two suppliers, did Sup- 
plier 1 know that you faxed it to Supplier 2 ? 

Mr. Kutz. I do not believe so. 

Senator Coleman. And if there were Suppliers 3, 4, 5, 6, 7, 8, 
9, and 10, would they have any — is there any system in place that 
would alert any of the other suppliers that, in fact, a single license 
was being used multiple times to obtain quantities of material in 
excess of the license’s “allowable amount”? 

Mr. Kutz. Not that we are aware of. As I mentioned in the open- 
ing statement, I think if we had been patient, taken our time, and 
had a little bit more money, we could have continued to purchase 
machines with radioactive materials. 

Senator Coleman. One of the recommendations in the report 
concerns the ability to counterfeit. You were able to change the 
quantities and material that is involved. You could have sent it out 
to multiple suppliers. I take it, from what we have seen in the past, 
that, for terrorists, getting and having money has not been a prob- 
lem. 

I have talked about a web-based system. Can you respond to that 
recommendation? 

Mr. Kutz. For the counterfeiting issue? 

Senator Coleman. Yes. 

Mr. Kutz. Yes, that would be a better way to address the coun- 
terfeiting. I think the reason I mentioned in my opening statement 
that a solution may be several years away is I believe NEC’s docu- 
ments are showing 2009 as the implementation date for a web- 
based system. So, in the meantime, that vulnerability will still 
exist unless they have other alternative means for suppliers to be 
able to look to determine that a license is counterfeit. 

Senator Coleman. And when we say web-based system, that 
would mean that you would have a single database that people 
would go to, that suppliers or others would have to go to the single 
database, and this database could indicate whether, in fact, mul- 
tiple suppliers were being employed and whether the license was 
being used beyond its intended purpose? Is that correct? 

Mr. Kutz. Yes, for the counterfeiting, we believe that the web- 
based system would have great potential. 

Senator Coleman. What is the application fee from the NEC for 
this license? And what is the application fee from one of the Agree- 
ment States, from Maryland? 

Mr. Kutz. For NEC it was $1,200; for Maryland it was $1,000. 

Senator Coleman. So the NEC license, the application fee was 
a little more, and yet they didn’t require a site visit? 

Mr. Kutz. Eight. Maryland was going to actually visit our facil- 
ity, tour the facility, and take 7 months for the process. The NEC 
process, as we mentioned, took 28 days, and so from a cost perspec- 
tive, I would assume Maryland would have cost a little bit more 
to do that work. 

Senator Coleman. I am trying to understand why a site visit 
may not be recommended. In 2007, after the sting, the NEC did 
change the regulations and talked about a visit. Did that visit 
mean a site visit, or it could have meant some other kind of visit? 
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Mr. Aloise. Are you talking about their new interim guidance? 

Senator Coleman. Yes, new guidelines. 

Mr. Aloise. It is an either/or. They are either going to have a 
site visit or they are going to allow for a face-to-face visit in an 
NRC office, which we do not believe is as good as actually touring 
the site. 

Senator Coleman. So, in fact, you had to shut down your appli- 
cation when Maryland said they were going to tour the site because 
there was no site. 

Mr. Aloise. There was no site. 

Senator Coleman. Is this a volume issue? Is the NRC so over- 
whelmed with applications that it is difficult or impossible for them 
to actually do site visits? 

Mr. Aloise. There are always resource issues to be addressed. 
The States have to address them, too, but the States are able to 
make the site visits as well. 

Site visits are something that should be explored through con- 
tracting or however it needs to be done, but it needs to be done. 

Mr. Kutz. Well, Senator, I would say, too, with respect to the of- 
fice visit versus the site visit, certainly the office visit is an im- 
provement from what we had because Special Agent Cooney re- 
ceived two phone calls. So on the phone, it is easier to engineer the 
situation than face to face. I am not discounting that an office visit 
would be tougher, but it is possible to beat an office visit. 

Senator Coleman. Senator Carper had a wonderful statement. 
He said, “If it isn’t perfect, make it better.” Clearly, a visit to the 
office is better than no visit, but a site visit to determine whether, 
in fact, there is a site is obviously better than a phone call or call- 
ing somebody into the office. 

Mr. Kutz. Yes, we would consider that the gold standard. 

Senator Coleman. And as a result, do you believe that the June 
2007 interim guidance solved the problem? 

Mr. Kutz. Well, no. Again, I think there are three parts to it. I 
think that the issue of office visit is only one element. The other 
issue you mentioned, counterfeiting, has not been solved. I think 
there is a third element here, the human capital element. Part of 
what we do in testing, oftentimes you have good policies on paper, 
but you are able to b^eat the people. And that is the other part of 
this, I think, that needs to be addressed. I think they have talked 
about additional training from the standpoint of security and how 
to recognize, and even in the guidance they had in 2006, there were 
certain steps that if someone had followed for our test, like done 
a Google, for example, they would have figured out that we do not 
exist. 

Senator Coleman. Let me talk about the amount of material. 
There are some who would argue that these are insignificant 
amounts. In fact, as I recall the Time Magazine report about the 
London terrorists, they were actually taking apart smoke detectors 
to try to create some kind of dirty bomb. 

Can you respond to the notion that we are really dealing with 
insignificant quantities here? And, again, it gets back to this issue 
that we are making this to appear to be a bigger problem than it 
really is. 
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Mr. Aloise. Senator, of course, there is a lot of debate about this. 
It is almost like asking how many sticks of dynamite it takes to 
make a car bomb. The point is once an explosion occurs, or a dis- 
persal event happens, and first responders’ radiation detectors go 
off, the consequences start from there. You do not know what it is 
you are dealing with. You do not know how much. You do not know 
how dangerous the isotope is. So you are going to have to take ac- 
tions like evacuating the area, shuting down businesses, closing 
down transportation. 

No one knows what the impact would be. That is why it is so im- 
portant to prevent it. 

Senator Coleman. And there is no question in your mind that, 
with the phony license that you received for a bogus company, you 
would have been able to obtain enough material to construct a 
dirty bomb that, if exploded in a place like Wall Street or some 
other area, would have significant economic impact and psycho- 
logical impact beyond just the loss of life that may or may not have 
occurred? 

Mr. Aloise. We are absolutely convinced. 

Senator Coleman. Thank you, Mr. Chairman. 

Senator Carper. You are welcome. 

Senator Akaka, you are recognized for 8 minutes. 

Senator Akaka. Thank you very much, Mr. Chairman. 

First, I would like to thank GAO for their hard work over the 
years and their hard work for this Subcommittee on this issue. And 
I thank Senator Coleman and Senator Levin for keeping this issue 
in the spotlight. 

After hearing your testimony, Mr. Kutz, that GAO has made rec- 
ommendations and also has reported results of your findings, and 
that you are recommending that NRC licensing be strengthened, 
although still early this year your covert process found that it did 
not work, so, Mr. Kutz, GAO has recommended that NRC consider 
the social and economic impacts of radioactive sources using a dirty 
bomb. Given the difficulty in measuring these aspects, my question 
to you is how NRC might do this? 

Mr. Kutz. There are several elements of this. There is the site 
visit that we believe is important, and I know that even under 
their old process, the site visit was going to happen, but possibly 
a year after you actually got your license. We still believe a face- 
to-face site visit would be a good step before you issue a license. 

We mentioned the issue of counterfeiting. Even if you do the site 
visit, suppliers who receive a faxed copy of an NRC license that is 
counterfeited still today could possibly end up shipping to someone 
with malicious intent. So the counterfeiting issue needs to be dealt 
with. And as I mentioned, the human capital element of this, hav- 
ing people trained in whatever guidance exists, assuming the guid- 
ance becomes solid and good, are people trained in actually looking 
at this from a security standpoint in addition to the scientific and 
technical standpoint? We think that is also something that they 
need to consider from a training standpoint. 

Senator Akaka. All right. Well, thank you very much. 

Thank you, Mr. Chairman. 

Senator Carper. Thank you. Senator Akaka. 

Senator Collins, you are recognized for 8 minutes. 
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Senator Collins. Thank you very much, Mr. Chairman. 

Mr. Kutz, I was struck with how different the response was from 
the State of Maryland versus the NRC, and if you had asked me 
prior to this investigation which entity would have done a more 
thorough review, I would have guessed without hesitation that it 
would have been the NRC and not the State Government. So I 
think that is a very interesting finding because the scrutiny of the 
two applications was dramatically different to the point where 
GAO abandoned its plans to pursue the license from the State of 
Maryland. There are, however, 33 other States, in addition to 
Maryland, that have agreements with the NRC and, thus, the au- 
thority to issue licenses. 

Do you have any idea whether the quality of the review process 
in those other States is as stringent as it was in Maryland? 

Mr. Kutz. I will let Mr. Aloise add, but I am not aware of that. 
I know that after we did our operation, NRC immediately held, I 
believe, a teleconference with all the States to tell them what we 
did, how we did it, to make sure that they were alerted, which was 
a positive step, we believe. But I would expect they are not fol- 
lowing the exact same process in all 34 States. 

Mr. Aloise. Senator, when we did our report in 2003 for Senator 
Akaka, we did not survey all the States, but we did come across 
a number of States that also made site visits. South Carolina and 
Georgia come to mind. And State officials told us that they thought 
a lot of other States were making site visits. 

Senator Collins. I just wonder — and I am very glad to hear the 
NRC shared the results of the recommendations. 

The Nuclear Regulatory Commission I would have expected to 
have the most stringent of all procedures, but I would suspect that 
smaller States with fewer resources — a State like mine, for exam- 
ple, which has tight budget constraints and perhaps limited exper- 
tise in this area — might not have the kind of intensive scrutiny 
that a larger State would have. 

Could you tell me more about how the Regulatory Commission 
licenses States or enters into this agreement? Could you tell me 
more about the process for allowing States to undertake their own 
licensing? 

Mr. Aloise. They basically have to meet NRC’s requirements for 
taking over the licensing process, and then NRC reviews them peri- 
odically to make sure they are still operating the way they agreed 
to operate. 

But, in some cases there may not be all that many licensees in- 
volved. It depends on the type of material. In some cases, there are 
55 licensees for a specific amount and type of material, and in 
other cases there are more. It depends on the State, and, you are 
correct. State resources. 

But, again, when we met with the State organizations, most of 
them thought that they were — or a lot of them were — doing site 
visits. They believe it is that important. 

Senator Collins. Are the majority of licenses issued by the 34 
States or by the NRC? 

Mr. Aloise. The 34 Agreement States have about 80 percent of 
the licensees. NRC has about 20 percent of the licensees. 
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Senator Collins. That is what my understanding was. That sug- 
gests to me that we should also take a look at how the States im- 
plement this. If the vast majority of licenses are being issued at the 
State level, perhaps we should do some sort of assessment or ask 
the NRC to do some sort of assessment testing the quality of the 
State regulatory schemes. 

The second issue I want to raise with you, Mr. Kutz, is how you 
went about counterfeiting the license that you received from the 
NRC. Did this take any special expertise? Were you able to use off- 
the-shelf software, or did you have special expertise that the aver- 
age person would not have access to? 

Mr. Kutz. One of the basic rules when we do these kind of oper- 
ations is to only use publicly available information, hardware, and 
software. So what we did, we bought from public sources that any- 
one could buy from, whether it be the paper or the actual machines 
that we used. 

Senator Collins. That was a point that I wanted to emphasize 
because you were able to do this, it seems to me, very easily, so 
it does not take access to specialized equipment or esoteric software 
or a lot of expertise to undertake the kind of counterfeiting that 
you were able to accomplish. Is that correct? 

Mr. Kutz. Yes. Well, not only that, we probably were much more 
sophisticated than we needed to be because at the end of the day 
all we had to do was fax this to a supplier. And, a fax copy is not 
as good as an original, so I think a cut and paste would have poten- 
tially even worked because over a fax you are not going to know 
the difference. 

Senator Collins. That is true. Yes, Mr. Cooney? 

Mr. Cooney. I would like to add that this particular license is 
really very easy to counterfeit. As you know, you can counterfeit 
anything. However, the NRC license in particular has really no se- 
curity features in it. It has no watermarks. It has no microprinting. 
It has no holograms. So it begs the question to be asked even if 
there are any real counterfeits out there that we do not know about 
because it was such an easy item to reproduce. 

Senator Collins. And that raises an important question as well 
of whether the Commission ought to be reviewing licenses that 
have been issued and do some sort of security check, given how 
easily you were able to counterfeit it. 

Is there a role here to be played by the suppliers? You talked 
about that you faxed the counterfeit license to two suppliers, and 
the amount that you were able to order far exceeded the amount 
that you were licensed for. Is there a role for suppliers in reporting 
back to the Commission when there is a purchase? Is there any 
feedback loop that might allow the counterfeiting to be identified 
through the supplier providing information to the Commission? 

Mr. Kutz. Yes. I would mention on the other one that NRC has 
said they are going to do a lookback to see if there are counterfeit 
licenses. Back to your prior point, I believe they are going to take 
a shot at looking back to see if something has happened in the 
past. 

With respect to suppliers, the interesting thing about the sup- 
pliers is that what they cared about the most from us was doing 
a credit check and whether we could actually pay for what we 
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wanted to buy. They were not as concerned — I mean, they assumed 
that since we had this license that it was genuine, and so they did 
not have any means to determine that it was not. So the web-based 
system that has been discussed would seem to me to be one of the 
solutions for the counterfeiting because again — and we found this, 
again, in all the operations we do when we are dealing with things 
like this. Entities like this, and I think Mr. Cooney can explain to 
you how disappointed they were when they found out that ours was 
not a legitimate order. This was big to some of these small busi- 
nesses, so they were most interested in getting the business. The 
security feature was not that important to them. 

Senator Collins. Thank you. Thank you, Mr. Chairman. 

Senator Carper. You bet. 

Gentlemen, thanks very much for your testimony and for your 
work. I was sitting here just thinking that I am glad GAO is on 
our side. We appreciate your efforts in this matter. 

Senator Coleman. Mr. Chairman, could I ask one follow-up ques- 
tion? 

Senator Carper. Certainly. 

Senator Coleman. Were you going to dismiss the panel? 

Senator Carper. No. I am going to ask some questions. 

Senator Coleman. OK. I thought you said you were done. 

Senator Carper. Oh, no. Just warming up. [Laughter.] 

I want to go back to the last point that Senator Collins was mak- 
ing. The suppliers, the potential suppliers, the willing suppliers 
here, they are in this to make money like most businesses. Their 
primary responsibility certainly is not to safeguard these materials 
and to make sure that they are secure and do not fall into the 
wrong hands. 

I do not know if you have talked to the suppliers themselves. Do 
they feel any compunction at all with respect to — or any concern 
at all about these materials falling into the wrong hands? Or do 
they just figure show me the license, we believe you are good to go, 
send me your money, we will check your credit, and it is a done 
deal? What is their approach? What is their mind-set? Mr. Aloise. 

Mr. Aloise. Well, that certainly describes the two we are talking 
about — we just dealt with the two in this test. I think Mr. Cooney 
can elaborate. They were interested in the size of the business and 
getting our money. 

Mr. Cooney. They were disappointed that they did not get our 
business, of course. However, when we spoke to them afterwards, 
they stated that they followed all their procedures that they were 
mandated by, and they 

Senator Carper. Mandated by whom? 

Mr. Cooney. By their own internal protocols. But they felt that 
the NRC should guarantee in some way the license presented to 
them. They are looking at NRC to say that the license is good. It 
should not be on them, the business, in their defense, to have to 
determine that the person is legitimate if he possesses and pre- 
sents them with an NRC license. They are assuming that the li- 
cense is OK, and they are assuming that NRC has granted it under 
legitimate means. 
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Senator Carper. I would say to my colleagues, that reminds me 
a little bit of the immigration debate with respect to employers, 
knowingly or unknowingly, hiring illegal aliens. 

Just a word or two, your thoughts with respect to the adequacy 
of their internal procedures for the suppliers. Any thoughts? 

Mr. Kutz. Well, again, from a security standpoint, I think there 
is more that needs to be done. They were not really going to chal- 
lenge anything. We could have done a much less elaborate process, 
taken a license off of the web page, the web basically, just counter- 
feited it and faxed it to them and potentially gotten the materials. 
So they really did not have a mechanism in place at this point. 
That is why, again, I think this web system has potential for a 
place where they can go from a secure perspective to determine 
whether the people they are dealing with are genuine and that the 
amounts that we are asking for are within the guidelines of the li- 
cense that we have. 

Senator Carper. Mr. Cooney, you mentioned that the suppliers 
were disappointed not to be able to make the sale. Were they will- 
ing to offer quantity discounts to GAO? 

Mr. Cooney. Yes, and in their quotes they gave us quite a dis- 
count based on volume. 

Senator Carper. All right. Thank you. 

Mr. Kutz. They actually offered us twice as many machines as 
we requested, so when we requested the first set of machines, we 
actually got a quote back for twice as many machines as we had 
actually requested. 

Senator Carper. I would just say to my colleagues as an aside, 
I have been over in Iraq and Kuwait looking into contracting, some 
of the military contracting that goes on, a lot of them no-bid con- 
tracts, and we are paying a lot more money for stuff than we ought 
to be. We ought to put these guys to work on this and get them 
out there to get us some better deals on the legitimate contracting 
side for the Department of Defense. I say that with tongue in cheek 
not entirely. 

Mr. Aloise, the GAO identified a vulnerability that could be ex- 
ploited to obtain nuclear materials, but just to be clear, are there 
any sort of guidelines used by the NRC that govern the amounts 
of material that could be used in dirty bombs as opposed to guide- 
lines that deal with health and security? Let me just start with 
that, and then I will follow up. 

Mr. Aloise. NRC probably could answer that better than I could. 
But I do know that they analyzed the amount we had, for example, 
to determine the potential consequences of the amount of material 
we could have gotten. They are very capable of doing that. 

But, again, our point is that the point of a dirty bomb is not its 
scientific aspects, or the amount of material that is being used, but 
the socioeconomic effects of the dirty bomb. 

Senator Carper. All right. And to follow up, I believe NRC has 
focused on Category 1 and 2 quantities, larger quantities. How do 
these quantities differ from the quantities of material that GAO 
was aiming to obtain or could have obtained? 

Mr. Aloise. Well, Category 1 and 2 materials require more strin- 
gent controls. They are more dangerous so obviously they have 
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more controls. However, we think, if we had pursued this further, 
we probably could have got up to Category 2 levels. 

Senator Carper. Do I understand that Category 4 is the lowest, 
the least 

Mr. Aloise. Category 5 is the lowest. 

Senator Carper. OK. And you were lining up to obtain — get 
somewhere at a low level Category 3? 

Mr. Aloise. I think we reached the bottom of Category 3. 

Senator Carper. Thanks very much. 

Mr. Aloise. I might add. Senator, we have surveyed other coun- 
tries and how they track materials. We surveyed 20 countries in 
another report. Fourteen of those countries track at least Category 
1 through 3 quantities of materials. NRC is right now concen- 
trating on Category 1 and 2. And nine of those countries track all 
the way down to Category 5. So other countries take this seriously 
as well. 

Senator Carper. Good. Well, I suspect we will, too, in the future 
thanks to your work. 

Let me talk with you for a moment about stolen materials. We 
are discussing here today the prospect of a real company, a sup- 
plier, a legitimate company, being willing to make a sale in this 
case to a sham operation that you guys started because you pre- 
sented what appears to be a legitimate license and request for that 
material. What do we know about the safeguards that are in place 
to prevent materials from being stolen that might be stolen from 
a legitimate business. They could be from someone maybe who 
works for that legitimate business or simply just stolen from a 
business from the outside. Can you help me on that? 

Mr. Aloise. Of these devices we are talking about, I think our 
report in 2003 said that over a 5-year period there were about 
1,300 of these devices stolen in the United States. About 250 a year 
were stolen, lost, or abandoned. NRC reports that most of those 
were reclaimed. A lot of these are left at a construction site. Those 
kinds of things occur. But they usually take prompt action, and 
once they are notified of that and try to get it back. 

Senator Carper. All right. I have a couple more questions, but 
before I ask those, let me just yield back to Senator Coleman. Or, 
Senator Collins before she walks out of the room, do you have any 
other questions you would like to ask of this panel? 

Senator Collins. I do not. Thank you. 

Senator Carper. OK. Senator Coleman. 

Senator Coleman. Just actually a quick follow-up to Mr. Cooney. 
The difference between the interview — the site visit versus an of- 
fice interview. I know my staff has been talking to the NRC about 
this, and I think they would say that — first of all, they are Ph.D. 
reviewers who review these applications, and I think they may say 
that those reviewers would “eat a phony applicant’s lunch” in an 
interview, that they would be able to spot them in the interview. 
Do you think an interview with an NRC regional office would have 
exposed you or blown your cover? 

Mr. Cooney. Senator, I am quite confident, having dealt with the 
gentleman I dealt with in the review process, that had I met him 
on a one-to-one basis I could have got through the process fine. 
Early on in our discussions, I determined that he was more inter- 
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ested and focused on the process of how to fill out the application 
rather than to determine the legitimacy of my use for the applica- 
tion. So I believe with the training that I had online, taking the 
RSO course, and my learned experience on the machines that we 
received through the Internet, that I would have been able to suc- 
cessfully get through that interview. And also, as you know. Sen- 
ator, last year on the other case we did coming across the border, 
we were also face to face with law enforcement people, and we got 
through there also. 

Senator Coleman. And in that case, the good news is they found 
the materials; the bad news is that after they found it, with phony 
documents you were able to get it through. 

Mr. Cooney. Correct. 

Senator Coleman. And so, Mr. Kutz, I go back then to the dif- 
ference between an office visit versus a site visit. You are of the 
opinion that a site visit would be a much more effective way to dis- 
cover whether something is bogus or not? 

Mr. Kutz. It would be the most effective way, yes. 

Senator Coleman. Absolutely. Thank you. Thank you, Mr. Chair- 
man. 

Senator Carper. You bet. 

Gentlemen, let me ask you a couple more questions and then we 
will excuse you and bring on our second panel. I would like to have 
us discuss NEC’s responsiveness to your investigation, to your 
sting operation. I find it troubling that ICE apparently cited con- 
cerns in, I think — was it 2003? And it took NRC some 3 years to 
improve their licensing process. After they had done that, it took 
you all about a month or less to, I guess, thwart the newly im- 
proved process. 

In your mind, was it legitimate for NRC first of all to take 3 
years to respond to your initial concerns? And how long should it 
take the NRC to respond fully to the concerns that you have raised, 
I guess to the lessons learned and the recommendations that you 
have made? How long is long enough? 

Mr. Kutz. Well, I will respond first. With respect to what it ap- 
pears, the first step was a good step requiring a site visit or an of- 
fice visit. What they have done on the training front we do not 
know. But the one that looks like it is going to take the longest is 
the web-based system, which they now say is 2009. And whether 
there will even be an implementation period over several years, 
that could even be further than that, so added years. 

Senator Carper. How would that web-based system work? 

Mr. Kutz. Well, one element of it could be related to the sup- 
pliers you talked about. The suppliers could get a secure way to get 
into that system to determine within a matter of minutes whether 
someone ordering materials from them has a genuine NRC license 
and whether or not they are authorized to purchase the type of ma- 
terials that they are submitting an order for. That has potential to 
deal with the counterfeiting issue. But that is several years away. 

Senator Carper. I do not pretend to be an expert about these 
things, although I did spend last night in a Holiday Inn Express. 
[Laughter.] 

Not really. I spent last night at home in Wilmington. 
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Two years seems like a long time to put up a system like that 
to a lay person. Your thoughts? You guys maybe know more about 
this stuff than I do. You probably do. 

Mr. Aloise. Senator, again, we made this recommendation in 
2003. We are not clear on why it took 3 years to address it, and 
then address it with procedures that we were, as you point out, 
able to beat in 28 days. 

I know NRC will argue with this, but in our view, they do not 
take the threat of these materials as seriously as we and others do. 
It is not that they discount the threat. I am not saying that. But 
if they took it as seriously as we did, they would have closed this 
gap in less than in 3 years. 

Senator Carper. All right. I think I am going to stop there, and 
let me just conclude. Senator Coleman, my understanding is that 
this is an issue you had more than a little bit of interest in over 
the years, and I commend you for that. 

I especially want to commend our folks at GAO for the work that 
you have done in this regard, and I look forward to our next panel 
to hear from the NRC to hear their side of the story and what they 
have been doing in response to your recommendations. 

I would just close this first panel by observing that this is a dif- 
ferent world than we live in today, different from the kind of world 
that we grew up in and even the kind of world that we had when 
I was Governor of Delaware and about to come here to the U.S. 
Senate in 2001. Like it or not, our world has changed, and the na- 
ture of the threats we face has changed as well. We have to be 
more vigilant when we make mistakes like we have here, and those 
mistakes have been identified, and we have got to act promptly, 
with dispatch, to address them. 

Thank you for your work in this regard, gentlemen, and we look 
forward to continuing to work with you in the years ahead, and we 
also look forward to our next panel. Thanks so much. 

Commissioner McGaffigan, I am going to ask you to rise and 
take an oath, please. Do you swear that the testimony you will be 
giving before this Subcommittee will be the truth, the whole truth, 
and nothing but the truth, so help you, God? 

Mr. McGaffigan. I do. 

Senator Carper. Thank you. Please be seated. 

Commissioner McGaffigan, it is always good to see you. Today I 
am glad you are here, but I wish you did not have to be here. I 
wish, frankly, none of us had to be here. But since this issue is be- 
fore us and I know this is an area that you have a lot of interest 
in and a lot of background, we are pleased that you could be here 
to respond on behalf of the NRC. 

You will be recognized for 10 minutes, and I would ask you to 
begin your statement. Once that is completed, we will probably be 
calling on Senator Coleman for questions and then Senator Akaka. 

Thank you. Please begin. 
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TESTIMONY OF EDWARD MCGAFFIGAN, JR.,i COMMISSIONER, 
U.S. NUCLEAR REGULATORY COMMISSION 

Mr. McGaffigan. Thank you, Senator Carper, Senator Coleman. 
I am not going to go through my full statement because I want to 
save some time to talk about some of the issues that have been 
raised. 

The early part of my statement, my background section, was in- 
tended to convey what we believe we have done since 2001 to deal 
with the dirty bomb issue. We feel that we have been a world lead- 
er on almost all of these things. The Code of Conduct renegotiation 
that occurred in 2003 was heavily influenced by an NRC DOE re- 
port. We got the right radionuclides and we got them in the right 
quantities in defining Categories 1 and 2 in the Code of Conduct. 

We did not wait 3 years, as one of the slides will show, to imple- 
ment the 2003 GAO recommendation for high-risk sources in Cat- 
egories 1 and 2. We did that starting in 2003, I believe, with the 
large panoramic irradiators and continuing in 2004 with manufac- 
turers and distributors and then broadening it further in 2005. So 
for high-risk sources, this sting would not work. For high-risk 
sources, if you are trying to buy a gamma knife for a hospital, if 
you are trying to start a large panoramic irradiator to sterilize 
medical equipment or food, a sham company would be caught in- 
stantly. And a sham company would have been caught instantly a 
long time ago. We give those applicants very tight scrutiny. 

GAO did find a flaw in our system, and we, as soon as we under- 
stood it, dealt with it. NRC has the interim guidance that the GAO 
witnesses have described, and they believe that guidance solves 
most of the problem, and I can talk about the mandatory site visit 
perhaps in questions or later. 

We appreciate GAO telling us about this vulnerability in late 
May and early June of this year, and almost immediately we took 
some initiatives, and within 2 weeks we had interim guidance that 
we really think solves the problem in the short term. We have 
longer-term solutions like this web-based licensing that we are 
aiming to do, and going to Category 3 sources is something that we 
are studying. I personally favor it, but to do rulemaking in this 
country, we have to follow the Administrative Procedures Act, and 
we have to have data. And we are gathering that data. 

I suggested last year in one of my votes that we not just go to 
Category 3 sources but we go to one-tenth of the lower end of the 
Category 3 threshold, which would be a factor of 10 above the top 
threshold of Category 4. And only if I go to that, to one-tenth of 
Category 3, would I have caught this particular sting by GAO. 

So we are serious about this stuff. Most people in the world re- 
gard us as a world leader. I cannot imagine any country having the 
resources that the GAO witness just suggested to follow Category 
5 sources. The number of exit signs in America, the number of 
home smoke detectors in America do not lend themselves to that 
degree of scrutiny. So these countries have to have exempt levels, 
and they have to have levels where they provide minimal attention, 
or else they are literally following hundreds of millions of devices. 


^The prepared statement of Mr. McGaffigan with attachments appears in the Appendix on 
page 50. 
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The NRC, as I said, took this seriously. We have a game plan 
to go forward. We intend to expand our scrutiny of source security 
issues to lower-risk souorces, but we clearly in the past few years 
have had to work on first things first. We have to work on the 
gamma knives and the large panoramic irradiators and other high- 
risk uses of these materials. 

I would say that one of the points made — and we are guilty our- 
selves in this point. One of the points made by GAO in their 2003 
report was that there are hundreds of sources lost every year. Deal- 
ing with Americium, for example, the threshold in the NRC quar- 
terly report for determining whether a lost source must ve reported 
in 30 days is ten-billionth of a curie. The threshold for reporting 
a lost source immediately is one-millionth of a curie, the amount 
in a smoke detector. These are quantities that are not relevant to 
dirty bombs, and the Commission has very recently directed the 
staff in the future to use Code of Conduct category levels to report 
these sorts of events. The fact is that in the last 11 years that I 
have been with the Commission, the only high-risk sources that 
have ever been lost and not recovered are devices used in oil and 
gas exploration using iridium-192, a radionuclide that has a rel- 
atively short half-life of 74 days. 

The number of those sources lost and not recovered is in the 
handful in the 11 years I have been at NRC, and because they 
have such short half-lives, you just wait a while and they decay 
away. Sometimes they are lost in the Gulf of Mexico. Sometimes 
they are lost in deep waters. And they are very hard to recover. So 
we do not lose significant sources and not recover them. Even small 
sources such as moisture density gauges — when they are lost, we 
or the State do everything we can to recover them rapidly because 
somebody could, if they unshield the material, get themselves a sig- 
nificant dose, and we do not want that to happen. 

One other point I want to make. We talk about dirty bombs as 
being “weapons of mass disruption.” I personally think that we con- 
tribute to that, that this psychological fear that we have is a com- 
bination of threat inflation on the part of the terrorists’ capabili- 
ties, combined with lack of knowledge of real radiation effects, and 
I can go into that in the questioning. But we should not aid and 
abet terrorists by fearing things that are the equivalent of working 
in the Capitol or in the Library of Congress where you can get 100 
millirems a year, or the radon in your home, if you have not ame- 
liorated it, can give you 400 or 500 millirems a year, or getting a 
CT scan of your chest and abdomen, which might give you 2,000 
millirems in one dose. The American people I do not think are that 
fragile. Franklin Roosevelt said, “The only thing we have to fear is 
fear itself” We have to do a better job of having a dialogue with 
the American people about which of these threats is severe and 
which are not. And in this instance, I honestly think that we have 
people who hype threats. On one of the TV news shows last night, 
there was a fellow who is always hyping threats who wants to 
clean up things to one-millionth of background radiation. 

That would not be sane public policy. If we can have a dialogue, 
it should be about the Department of Homeland Security’s guide- 
lines. The Department of Homeland Security has put out protective 
action guidelines for what happens after a dirty bomb attack. 
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Those guidelines were strongly supported by the States. They are 
strongly supported by us at the NRC. They are supported by EPA. 
They are derivative of EPA guidelines. 

If we can follow those guidelines during an RDD event, there will 
not be the sort of panic that everybody assumes. We have done one 
exercise. In 2002, TOPOFF II, a very senior exercise of the U.S. 
Government, looked at a very large dirty bomb, factors of 1,000 or 
10,000 larger than the material GAO was able to potentially pro- 
cure. And the mayor of Seattle, where this bomb was assumed to 
go off, was given a choice of following the then-EPA, the now-DHS 
Protective Action Guides, or letting his city be paralyzed poten- 
tially for years to try to get to perfection cleaning it up to one-tenth 
of the dose in the Capitol, in the entire city. He chose to put his 
city back to work. He chose to restrict the very small area that had 
been contaminated to a large degree and where it really was unsafe 
to be there, people would get more than a CT scan of their chest 
and abdomen if they were there all year. And that is the EPA PAG. 

I know my time is expired, and I hope I have said a few provoca- 
tive things. But we have to have a better national dialogue about 
dirty bombs than we have had thus far. 

Senator Carper. Commissioner McGaffigan, thank you for con- 
tributing to that dialogue this morning with your statement and for 
your willingness to be here. 

I need to slip out and go meet with Senator Voinovich, ironically, 
and so I am going to turn the gavel over to Senator Akaka. But 
before I do, I will just repeat something I have said to you and to 
the other members of the Nuclear Regulatory Commission before. 
Everything that I do, I know I can do better. And I always say to 
my staff, “Everything that we do, we can do better.” I said that as 
Senator and as governor and any other roles I have played. The 
same is true with the NRC, as you know, and to the extent that 
we have identified some weaknesses here, things that need to be 
corrected, we expect you to address them. We realize there has to 
be some priority. Those that are most acute we need to address 
most readily. Those that are least critical we can address later. But 
to the extent that we in the Congress can be of support to you, and 
particularly Senator Voinovich and myself — I think I can speak for 
him as well — ^you need to let us know because we want to make 
sure these concerns are addressed. 

Mr. McGaffigan. Sir, as you know, that has been my philosophy 
since I came to NRC. We have constantly improved and we have 
not reached perfection. We are going to make things better, wheth- 
er it is in our oversight process for reactors or any part of our busi- 
ness. 

I would tell you that the greatest challenge we face with these 
information technology systems such as web-based licensing is 
getting the right people to work for us. It is almost impossible on 
government salaries to get the people that really are information 
technology experts. We are the best agency in government in many 
respects. We have been voted that. 

Senator Carper. I know. 

Mr. McGaffigan. But we are one of the worst agencies in gov- 
ernment at buying information technology. 
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I do not have a solution to that. We go out and we try to attract 
people at the senior level service level, which is what I get paid, 
and we have trouble. We are obviously not unique. The FBI, the 
Pentagon, the FAA, and others have had enormous difficulty in 
this area. But we try very hard to attract the right people. The gov- 
ernment hiring system — they can get paid so much more in the pri- 
vate sector if they are really good. We someday have to have more 
flexibility in the government system than we have today. 

Senator Carper. All right. Thank you for that comment, and 
with that I am going to recognize Senator Coleman for questions 
and pass the gavel over to Senator Akaka. Thank you so much. 

Senator Coleman. Thank you, Mr. Chairman. 

Mr. McGaffigan, let me just start by identifying three areas 
where I am in agreement, and I think it is important to stress your 
first comment about tracking Category 5 and the difficulty, just 
some practical limitations we have here. 

The Subcommittee staff report, which focuses on Category 3, says 
the NRC should consider including Category 3, and we use the 
word “consider” very carefully rather than “require.” We want you 
to look at that. That needs to be looked at. The fact that 14 other 
countries apparently do that I think carries some weight. We recog- 
nize that certainly at Category 4 and Category 5 it may not be cost- 
effective. But as you look at Category 3, that is the issue here, and 
so “consider” is the word, and we hope they have fully considered 
that. 

Mr. McGaffigan. Sir, we will. Category 3 sources are dangerous, 
as I have said in my votes on these issues over the years. And I 
would like to expand, but you have the Administrative Procedures 
Act that I am sure this Committee decades ago put into law, and 
we have to have the data to prove that benefits exceed costs to 
start that rulemaking. 

I believe we will get that data, and as I say, I personally would 
go to one-tenth of Category 3 in terms of the licensing so that we 
would have greater defense in depth in that area. 

Senator Coleman. The other area of agreement I want to men- 
tion in is the concern over getting technical folks, IT folks, to 
change systems. I had a conversation yesterday with the Commis- 
sioner of the IRS. Why can’t we, for 501(c)(3)s, which has been tak- 
ing up to 6 months to look at an application, why don’t we have 
a web-based system to deal with that? And the answer was just 
what you said: It is difficult to get folks who are top-notch in IT 
to do this kind of work, and as a result, they are looking to 2009. 

That does not make me very happy. It does not make me very 
happy at all, and I think we have to accelerate this. But I do want 
you to know that I recognize the limitations that we are facing, and 
it is very frustrating. 

Mr. McGaffigan. It is one of the great weaknesses in our sys- 
tem. Why doesn’t DOD have a better system for getting security 
clearances through? Why doesn’t the FBI have better ability to 
share data among analysts? Dealing with information technology, 
everybody talks about off-the-shelf technology. There is nothing off- 
the-shelf because it has to fit within the systems that the agencies 
already have, and it is just very hard. The Federal Information Se- 
curity Management Act is a very good act. It probably came out of 
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this Committee. But it is very hard to get contractors who fully un- 
derstand how to do that. 

In the National Source Tracking System, we are working with 
Lockheed Martin, and you would think that they could do the job 
and do it well. We are having problems. 

Senator Coleman. Again, there is a lot of frustration, and we 
need to accelerate the pace at which we get this done. 

Let me raise a third issue, which is kind of the overarching issue, 
and that is the danger of a dirty bomb. And I agree with you that 
we have to do a better job of a dialogue with the American people. 
The concern about a dirty bomb, as you are well aware, is not the 
death toll from the explosion itself. It is not even the amount of ra- 
diation sickness that would occur. It is the psychological and eco- 
nomic impact of radiological material being spread around a public 
place and the toll that would take. And so I do not think we are 
in disagreement over that. 

The concern that I have here and that this investigation reflected 
is that there is the ability to at least move into Category 3, and 
I do not think we have a chart. I am looking at NRC Licensing of 
Sealed Radioactive Sources, your document. 

Mr. McGaffigan. Yes. 

Senator Coleman. The IAEA Code of Conduct that identifies 
Categories 1 through 5 for both-what is it. Americium? Is that how 
you pronounce that? 

Mr. McGaffigan. Americium. 

Senator Coleman. Americium, and then Cesium-137. But what 
troubles me, what concerns me is that Category 2, Americium, is 
16 to 160 curies, and Category 3 is 1.6 to 16 curies. In other words, 
there is a thin line between the top end of Category 3 and the bot- 
tom end of Category 2. But there is a bright line in the procedures 
that the NRC employs in reviewing Category 2 versus Category 3 
and tracking Category 2 versus Category 3, and deciding to issue 
a license to Category 2 versus Category 3. 

Do you find that troubling? 

Mr. McGaffigan. I do not think the line is as bright in practice. 
The particular license that GAO was attempting to obtain was for 
the lower end of Category 4 of Americium. The lower end of Cat- 
egory 4 is 16 millicuries. They were attempting to obtain a license 
for 200 millicuries. They were attempting to do so in a State — West 
Virginia — where there is a very active industry that needs to make 
sure that when concrete and asphalt are laid that there are not 
holes in them. I am not trying to apologize for our licensing officer. 
We should have done better. But it probably sounded like a new 
small business trying to get into business. 

What I am actually more concerned about is the other two sup- 
pliers. There is a very limited number of suppliers of these mois- 
ture density gauges, and asking for 45 at once for a new business 
you have never heard of before, there should have been some bells 
going off. It should not have been, “Oh, my gosh, I am going to 
make a quarter of a million dollars on this sale,” which is probably 
about what they were quoted. I do not know the exact quote. 
Maybe my GAO colleagues could tell you. Instead of getting excited 
about, “Oh, my God, somebody is buying a quarter million dollars 
in gauges. It must be the biggest firm in West Virginia that some- 
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how just landed on the Earth,” they might have asked a question 
or two. They might have called hack to us, and we are going to re- 
inforce, I believe, the guidance to those folks and the manufactur- 
ers and distributors that we want to know about such transactions, 
please call us. 

But, yes, we have to have greater defense in depth in our system, 
and I would add to the points that are in my testimony that we 
are going to have to do a better job with these manufacturers and 
distributors to make sure that they are not putting the dollar 
ahead of the American people. 

Senator Coleman. One of the concerns, the highlight of the in- 
vestigation, is, “Does the right hand know what the left hand is 
doing?” So in this case, you have suppliers who saw a profit with 
no requirement to authenticate licenses where the web-based sys- 
tem would. What can you do in the short term to ensure that if, 
in fact, there were a terrorist group that was well funded that 
looked at the system and said, “Hey, right now, at least before any 
changes, we could go to a multiple source of suppliers.” By the way, 
not just in West Virginia. Could they have gone to other States? 

Mr. McGaffigan. The company was an alleged West Virginia 
company. The suppliers are limited. There are not a lot of people 
who try to make money off — there are essentially two, right? — two 
companies that they sought bids from. There are not a lot of other 
companies in this business. 

I do have some trouble with the notion that they could have ac- 
cumulated 450 of these gauges. If that supplier is so profit-moti- 
vated that they would sell 450 moisture density gauges, which is 
probably about as many as could possibly be used in West Virginia, 
Virginia, and North Carolina in this business, I think — I would 
hope that they might give us a call. But we will enforce that. We 
will reinforce that through messages to these people in the future. 

Senator Coleman. Because the concern is not limited to just one 
source. The GAO folks are figuring that it is pretty easy to get a 
license here. In fact, they think they could have just created one 
by just going on the web. And then you are going to fax it, so now 
if you could do it for this item, you could probably do it for another 
item or another item. 

Mr. McGaffigan. There are a limited number of items in Cat- 
egories 3 and 4 that we have to be careful about. We are going to 
look at that. 

Senator Coleman. That is what I am looking for. In other words, 
even pre-web-based systems, I would hope that what we would see 
would be a lookback with suppliers and others so that you cannot 
simply counterfeit a license, change the quantity of material you 
are authorized to buy, and then go to various sources to get that, 
to give you then the capacity to do something that could be dev- 
astating if used by bad people in a bad way. 

Mr. McGaffigan. We have been looking since February — and I 
should have, before coming here today, gotten updated as to what 
data we have, probably not full at this point. But we have been 
looking at these devices that are a factor of 10 below the Category 
3 lower threshold, a factor of 10 above the Category 4 upper 
threshold. And we need to just understand how these radionuclides 
of concern are used in real devices in those categories and how 
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much of a burden it is going to be to deal with. I suspect the bur- 
den is not going to be large, and we probably already have interim 
data, and I would be happy to share that with you once we fully 
understand it. 

I do also want you to understand that getting this material does 
not get you an effective dirty bomb. We design these moisture den- 
sity gauges so that the Americium inside is encapsulated in two 
different layers so that people cannot get at it easily, cannot hurt 
themselves. GAO would have had to taken the material out of 
those 45 devices, gotten through those two layers. They would best 
do that with at least some sort of glove box where they are pro- 
tecting themselves, or else they will kill themselves. And then they 
would have to figure out how to disperse it optimally. 

From what I have seen of al-Qaeda thus far — there was a lot of 
reference to this 2004 paper. That 2004 paper is scientifically inept, 
to be honest with you, and I hope al-Qaeda is still there. It may 
not be. And we do not assume they are inept. But it does go to this 
issue of — there are several steps they have to go through to get to 
a dirty bomb, and then the effectiveness of that dirty bomb is some- 
thing I would be happy to talk about. 

Senator Coleman. I have some other questions. What I will do, 
since I am over my time, Mr. Chairman, I will end this line of 
questioning and. Senator Akaka, I would like another opportunity 
then if we could just have a second round. I have some follow-up 
questions. 

Senator Akaka [presiding]. Fine. Thank you very much. Senator 
Coleman. We will have another round after this. 

Commissioner, you mentioned something about staffing, and I 
would like to ask about NRC staffing and, in particular, the types 
of people you hire. We have heard from GAO that NRC license re- 
viewers could easily be fooled by a sham company even in person. 
Do you believe it is time to hire NRC staff with other skills that 
enable them to assess the less tangible aspects of a license request? 

Mr. McGaffigan. Sir, I believe we have one of the most com- 
petent staffs in any agency in the Federal Government. You have 
a staffer who once worked for us, and we have had very high hopes 
for her. We are the training ground for a lot of other agencies, and 
we have been named the best agency in government. 

Because we have such a challenging mission, we tend to attract 
some of the best and brightest in our population. The numbers of 
PhDs and master’s degree holders in our staff would match any 
other agency in the government. So it is not a matter — we just got 
fooled in one case, and we will probably never get fooled again. The 
GAO staffer might have gotten past that person in our Region I of- 
fice near Philadelphia. I have my doubts. But that is an experiment 
that was not done. 

Getting past that person today in an office visit will be enor- 
mously harder, and “once bitten, twice shy,” as the old saying goes. 
NRC staffers are not going to get burned a second time with that 
particular scam. Our people are going to be very alert to it. The 
issue is, and what I commit to in my testimony, is we are going 
to do more red-teaming of ourselves in this area. We are going to 
look at our own vulnerabilities. We are going to be more vigilant 
on these lower-risk sources. And we intend to try our absolute best 
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to find vulnerabilities and fix them before GAO points them out to 
us in the future. 

That is not a challenge to the GAO, but that is [Laughter.] 

Mr. McGaffigan. But that is what our intent is, and we have 
various ideas. The Chairman has some ideas about bringing DTRA, 
the Defense Threat Reduction Agency, in to look at our licensing 
process. We are going to red-team ourselves more seriously. 

I do not think we have vulnerabilities — I hope we do not — at the 
top end of the spectrum because we have so much defense in depth 
there. But we have less defense in depth on these lower-risk 
sources, and we are going to find our vulnerabilities. That is a com- 
mitment. 

Senator Akaka. Well, as you heard, GAO identified a troubling 
vulnerability. 

Mr. McGaffigan. Yes. 

Senator Akaka. On the other hand, the use of radioactive sources 
is a necessary aspect of everyday life. We use these sources in med- 
icine, as you mentioned, at hospitals and what we might call com- 
mon places for diagnostic and cancer treatments and a wide variety 
of industrial uses. 

How do you balance and how does Congress balance the need to 
use the sources without significantly increasing costs and yet en- 
sure that dangerous quantities of those materials are not easily 
available for use in a dirty bomb or other sources here? 

Mr. McGaffigan. Senator, that is a very good question. There 
are some very complex cases I could give to you. We will not let 
anybody use cesium in a large panoramic irradiator. We absolutely 
will not let them do that. There is an ongoing National Academy 
of Sciences report that is looking at smaller blood irradiators used 
in hospitals throughout the Nation. There are two blood irradiators 
at George Washington University Hospital a half-mile from the 
White House where the Vice President goes for care. Those are 
Category 2 sources under the Code of Conduct, and we have in- 
creased security on those sources. 

But the dispersability of the cesium-137 within them is a ques- 
tion — it is something that we are trying to fix. There are ways that 
we can make those sources more secure, less attractive to terror- 
ists. But there are potentially tremendous costs involved for the 
hospitals and for the manufacturers, and we have a National Acad- 
emy of Sciences study due to the 2005 Energy Policy Act where 
they are trying — and they are going to report to us in September. 
They are trying to balance that cost/benefit calculation. How do we 
make small improvements, perhaps, at low cost to make those 
blood irradiators much less attractive to a terrorist? 

These are not easy issues, and we struggle with that routinely. 
Our bias is toward security, where security is effective but not 
overly costly. We do not protect the blood irradiators with guards 
and guns and gates and sensors. We protect them with a much 
tighter connection with local law enforcement. The hospitals today 
in a post-September 11 world have recognized this vulnerability. 
We have told them how to put extra sensors in. But we have also 
told them we are not going to have gun battles at George Wash- 
ington University Hospital. We are going to make sure that you 
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can summon the police, a lot of law enforcement real fast, if some- 
body tries to come in and attack those blood irradiators. 

It is a balance. 

Senator Akaka. Well, you mentioned. Commissioner, that the 
American public needs to understand better radiation, what it is 
and what are the effects of that. How do we, how does Congress, 
how do you, and how does the NRC do this? 

Mr. McGaffigan. It is something that every agency in govern- 
ment that deals with radiation, not just us but EPA, Health and 
Human Services, the Department of Homeland Security, and DOE, 
could do a better job at. EPA has a website where you can go and 
find out what extra dose you would get if you move to Colorado, 
which has much more uranium and thorium in the soil and you get 
much higher doses from that. In Colorado, it would also tell you 
that you would get a little bit of a higher dose from the altitude. 
It would tell you the extra dose if you live in a brick house as op- 
posed to a wood house, or the extra dose from granite tabletops in 
your kitchen. 

But it is a dialogue that does not happen — it is pretty boring in- 
formation. Should you have your home tested for radon? Should 
you accept your doctor’s judgment that you should get a CT scan 
of your chest and abdomen? Should you avoid the Capitol? Senator, 
because you go back to Hawaii so often, you get a very large dose 
flying from here to Hawaii. The most exposed people in America, 
on average, in a large group are not the people who work at nu- 
clear power plants. They are the people on airline crews who fly 
long distances. They get doses per year that are in the hundreds 
of millirems range, and we do not even badge them. In Europe they 
do. But we have not had this conversation with the public. I can 
tell you my personal view and what NRC regulates to and what 
other agencies regulate to. The annual dose for workers is 5,000 
millirem. That is our limit. A CT scan of the chest and abdomen 
is about 2,000 millirem. The average medical dose of Americans is 
about 340 millirems per year for diagnostic procedures. When your 
child gets braces, they will probably get about 50 millirems when 
the whole-mouth x-rays are done in preparation for the braces 
being placed. In the Capitol and the Library of Congress, where 
there is lots of granite, people get 80 to 100 millirems per year if 
they work 2,000 hours, the typical work day, and most people work 
for longer in the Capitol. 

When my son was a page for Senator Warner back in 2001 before 
September 11, in the spring of 2001, we mapped the Capitol using 
a radiation detector, and Tom Daschle’s office was the hottest place 
we found. Just outside of his office at the time, it was about 40 
microrems per hours. 

So what is a dangerous amount given that we live in a radio- 
active universe? That is the way it was created. It would not exist 
if it were not radioactive. And what is a dangerous amount? There 
are different views on that, and the government has a view, EPA, 
NRC, DOE, Health and Human Services. But certain other mem- 
bers of the public have a starkly different view, a much more 
alarmist view as to what happens if you take a plane flight or if 
you work in the Capitol, I guess. And the media tends to believe 
the truth is somewhere in between. One of the TV shows that I 
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was on last night — I was on two TV news shows last night very 
briefly. That increased my total number of career TV news appear- 
ances to three. I had been on TV once before in my career. But the 
media tends to believe the truth must lie somewhere between what 
the government experts say, who obviously love gamma rays in 
their lives, and these alleged experts, one of whom was on one of 
the shows I watched last night, one of the TV news shows. And 
that person truly believes that we have to clean up Mother Nature, 
I believe, that we should get down to hundredths of a millirem per 
year doses when we clean up things. 

So there is a difference, and I hope that in an emergency, as the 
mayor of Seattle did in 2002, in the Top Officials 2 exercise, that 
the mayor of Seattle will listen to the Federal Government experts 
and will try with the help of the State of Washington experts who 
were totally with us, to persuade the public that the risks they are 
taking are not large if they follow the Department of Homeland Se- 
curity and Environmental Protection Agency guidelines. I hope that 
that will be the result. 

Senator Akaka. Well, thank you. I am going to pass it on to Sen- 
ator Coleman for further questions. I will follow up after he is done 
with more questions. 

Mr. McGaffigan. OK. 

Senator Akaka. But here is one that can speak from the mayor’s 
perspective. 

Senator Coleman. And I thank you. Senator Akaka. As a former 
mayor, these are issues that we have to have a better conversation 
with our citizens about because, at some point in time, this country 
is going to experience a dirty bomb attack. I cannot tell you this 
year or next year, but that is the world in which we live and the 
nature of the threat, and we cannot stop every bad thing from hap- 
pening to us. And so it is all about how we respond and prepare. 

And perhaps out of this conversation. Commissioner, there is a 
dialogue that will help in that discussion. 

Mr. McGaffigan. I agree. I once tried to talk to the National 
Governors Association and I got blown off, several years ago, not 
exactly on this subject but on radiological threats. But the National 
Mayors Association, if they come to Washington, maybe we should 
have not me but Craig Conklin, say, from the Department of 
Homeland Security, who led the effort that resulted in the Depart- 
ment of Homeland Security’s guidance, talk to them so that we are 
talking not in the middle of a crisis, but we are talking to them 
about our recommendations as the Federal Government and we are 
talking to mayors. 

The trouble is that the radiation experts are oftentimes many 
layers below the elected official, and they may agree with us, but 
they get to see the mayor never or once every 4 years. 

Senator Coleman. I will work with you and with the NRC to 
make that happen. 

There are two areas I just want to follow up on. How many Cat- 
egory 3 licenses does the NRC issue during the course of a year? 

Mr. McGaffigan. Well, we issue a total of 200, and Category 3 
portion has got to be a very small number. 
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Senator Coleman. I want to get back to this issue of site visits. 
Why not simply say we are going to do site visits for Category 3 
licenses, as Maryland does? 

Mr. McGaffigan. Well, the data — we could do site visits. When 
we are doing applications, whether it is with power reactors or 
with Category 3 licensees, we tend to try to put the cost on the ap- 
plicant rather than on the American people. But we could probably 
do that. It is probably a relatively small reprogramming of money. 
We will take that into consideration. 

The number of site visits to applicants seeking Category 3 mate- 
rial or even a factor of 10 below Category 3, well into Category 4, 
which would have been needed to get this particular application 
that the GAO put before us, the fraudulent application, is probably 
not a large expenditure of money, and we will look at that. 

We may get pushback. We have 34 Agreement States. Some of 
them are very large, and they may find other ways to check the 
bona fides of applicants. Some of these large States — I worked for 
Senator Bingaman from New Mexico. They are large but it seems 
everybody knows everybody. And there are ways to check out peo- 
ple without necessarily making the visit. And our budgets, NRC 
budgets, are more generous than many of these State budgets. 

We have to talk not only about our own actions but the actions 
of 34 other States. My understanding is, for your information — and 
it is probably not good for you — is that Minnesota was following 
our guidance in this area prior to the GAO sting — which made the 
visits discretionary. And our information is only five States that we 
have thus far gotten an answer from — including Maryland, act like 
Maryland and do mandatory visits. And they may be the more com- 
pact States. 

So we will consider your recommendation and see where we go 
with it. For the NRC it is possible. 

Senator Coleman. Let us have that conversation because I think 
it is clearly worthwhile. Again, we want to get as close to perfect 
as we can. There is not a lot of room for error here, and I do appre- 
ciate your reflection that fooled once, shame on you, fooled twice, 
shame on me, that clearly the level of alert has been raised and 
the warning levels have been raised. But I think systematically we 
should have something in place that moves us as close to perfection 
in this area where the risk of failure can be so great, so cata- 
strophic. 

I just want to make one other comment. When you talked about 
the technical capacity of al-Qaeda, you did not diminish it, but you 
did question it. We’re talking here about what it would take to 
move this material into a dirty bomb. I just have to say, knowing 
what we are dealing with in Iraq today with lEDs, the Defense De- 
partment asked for $6.4 billion in February of this year to counter- 
lED’s, to counter the technological abilities of folks on the ground 
in Iraq. And I can tell you, having been there a number of times, 
we move to Level A and they go to Level B, and we go to Level 
C and they then go to Level D. And I think it would be a terrible 
mistake to underestimate the technological capability of this 
enemy. It would be a terrible mistake. And all you have to do is 
look at what we are dealing with, with lEDs, to understand the 
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simplicity and complexity coming together and the devastating im- 
pact of that. 

So I just want to put that statement on the record. 

Mr. McGaffigan. I appreciate that, Senator. I spent most of my 
career — I have been in government for over three decades — work- 
ing on defense issues. We also have to guard against threat infla- 
tion. During the Cold War, inflation of the Soviet threat, the notion 
that the Soviets could march to the English Channel at a moment’s 
notice and overwhelm NATO’s capabilities was never real. They did 
not have the sustainability to do that. They did not have the cohe- 
sion. They did not have the training. But it was a tenet of our pol- 
icy and it consumed large amounts of money to beat that threat 
that was being grossly exaggerated. 

So we also have to guard against threat inflation. We cannot 
make these people DOE National Laboratory capable. They have 
not evidenced that. Jose Padilla thought depleted uranium was 
something he could use in a dirty bomb, and that is not true. That 
2004 paper talked about buying smoke alarms. It would take 2.3 
million smoke alarms to get to the amount of material that GAO 
says it could have gotten. At $6 apiece, maybe you get a discount 
to $4, that would be pretty large sum of money. And then you 
would have to go through 2.3 million devices and try to get that 
little amount of Americium out. 

If that is where al-Qaeda was in 2004, sort of surfing the Inter- 
net — I am not trying to underestimate them, but they have a learn- 
ing curve to go through to get to the point where we assume com- 
petence. We assume competence in attacking George Washington 
University Hospital. But we do not assume that they have the 
same degree of competence that the best National Laboratory 
would have. 

Senator Coleman. Again, we will not debate this, but I would 
think it would be a tragic mistake to underestimate the learning 
curve. And it is not only al-Qaeda, Padilla or whatever. There are 
others in this world who do not like us, who have great capacity. 
The lEDs that we are seeing in Iraq, there is real concern that Ira- 
nians are producing highly technical, highly sophisticated weap- 
onry and putting it in the hands of folks who are killing American 
soldiers. And it would be a terrible mistake to underestimate the 
technical capacity of the enemies of this country who would have 
the ability to get radiological material and then to combine it in an 
explosive device. I really want to stress that. 

Mr. McGaffigan. I understand. If there is state help for the ter- 
rorists — 

Senator Coleman. And there is no reason to assume that this 
would not be the case in the world in which we are living today. 
We are seeing it on the ground right now where American soldiers 
are being killed by highly technical explosive devices that are being 
used on the ground by terrorists who did not think them up and 
make them themselves. 

Mr. McGaffigan. Right. We have to go after those countries if 
they ever do that, and I think we will be able to trace — if there is 
an RDD or a dirty bomb that ever gets set off in this country 

Senator Coleman. And we have to presume that they are capa- 
ble of doing it and do everything in our power to make sure that 
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there is not a dirty bomb attack. We have to prevent it rather than 
just respond to it. We have to assume that the capability is there. 
And I think that is the correct assumption and that, when the GAO 
says you do not take it as seriously, you need to take it seriously. 

Mr. McGaffigan. We take it very seriously. If we are up against 
states 

Senator Coleman. But you have to have the frame of mind that 
we have people who want to hurt us, who have the technical capac- 
ity, and assume the technical capacity and then make sure that we 
do all those things to make it more difficult, more difficult than it 
was when this sting took place, to get the material and then to in- 
flict the damage. And I just think that is the mind-set that we need 
and the NRC might not be there yet. My sense, even in this discus- 
sion, is that I still think there needs to be a reflection, a greater 
reflection as to the danger that we face. 

Mr. McGaffigan. If states start aiding al-Qaeda in designing 
RDDs that, in the case of Americium 

Senator Coleman. I will tell you today, Mr. Commissioner, that 
there are states aiding al-Qaeda. We know that in Iraq. 

Mr. McGafeigan. I understand. If there are states that do that 
and they use Americium, which is very hard to detect with the de- 
tectors that we have at our borders, that is a problem. That is a 
problem that the NRC cannot solve. Because it will have been 
brought into America covertly. But that is an act of war, in my 
view. 

Senator Coleman. Let us be prepared. I thank you for your ef- 
forts, Commissioner. 

Mr. McGaffigan. Thank you. 

Senator Akaka. Thank you very much. Senator Coleman. 

I want to just comment that Senator Coleman is correct to re- 
mind us that we have a thinking and learning enemy. And when 
Senator Coleman talks about prevention, it takes anticipation to 
deal with that and try to outthink or think beforehand what may 
be coming. I know in our country we do have a lot of young people 
who are doing so well in this area, and we need to use them well. 

Mr. Commissioner, we heard from GAO that suppliers do not be- 
lieve it is their job to assess the validity of a license or licenses. 
I happen to disagree. Can you tell me if the NRC has any plans 
to require suppliers to make sure a licensee or its license is legiti- 
mate? 

Mr. McGaffigan. We have given guidance in the past. It prob- 
ably has been at the Category 1 and 2 level. We definitely need to 
expand it to these sorts of devices. But we have given manufactur- 
ers and distributors very clear guidance in the past that they need 
to verify Category 1 and 2 materials, the legitimacy of the person 
seeking to buy, say, the gamma knife for Hospital X. 

As I said earlier, I am disappointed. Forty-five moisture density 
gauges being requested by a company that you have never heard 
of before should not have just set off dollar signs, $250,000 dollar 
signs in these people’s head. They should have done some checking. 
That is a lot of moisture density gauges for a start-up company to 
buy. And if GAO had tried to buy 450, I hope and pray — and they 
had the $2.5 million to do it — that they would have said, “My God, 
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this is insane. Something is wrong here,” and they should come to 
us. 

There is a limited number of people in the nuclear business deal- 
ing with devices at the Category 4 level, and including radio- 
nuclides of concern, not things like tritium that goes into exit signs, 
hear from the NRC. And we need to communicate with them. You 
are right. Senator Coleman is right. We need to make sure that 
they are alert and check with us if they have any doubt about the 
quantities being asked for of such devices. 

I do not expect them to call me when someone is buying one or 
two moisture density gauges, but 45 should have set off some bells 
and 450 should set off the largest bells we have in Washington. Ev- 
eryone should be ringing. 

Senator Akaka. Mr. Commissioner, in a March 12 , 2007, letter 
to the Environmental and Public Works Subcommittee on Clean 
Air and Nuclear Safety, Chairman Klein stated that one of the rec- 
ommendations from the August 2003 GAO report on NRC control 
of radioactive sources remained open. That recommendation per- 
tained to evaluation of the costs and benefits of requiring owners 
of generally licensed devices to apply for specific licenses and 
whether those costs are commensurate with the devices’ risks. 

Chairman Klein said that the NRC would start the process of 
drafting a new rule for fiscal year 2007 that would look at which 
devices containing radioactive materials should be generally li- 
censed and which were more dangerous and should be more tightly 
controlled through a specific license. 

Can you comment on the status of that initiative and what you 
believe the results might be? 

Mr. McGaffigan. I mentioned earlier the Commission has asked 
the staff to look at one-tenth of Category 3’s lower threshold and 
to give us data on how expensive it would be, not just for us but 
for the 34 Agreement States, to license that. 

Generally licensed devices can go down well into the Category 5 
range. We ask people to pay annual fees if they use generally li- 
censed devices containing, say. Americium or cesium or cobalt. We 
are not really looking at going down into Category 5 quantities, 
even though we sometimes ask people to pay if they have some- 
thing that is even down in the high part of Category 5. 

But we have something underway. Staff is going to give us rec- 
ommendations. We are in the midst of the data gathering in 2007. 
I think decisions by the Commission are likely to be made next 
year. And as I said, my bias is to specifically license to one-tenth 
of the lower threshold of Category 3, so halfway through Category 
4 is my bias as I go into that, as we wait for the data to be col- 
lected. That is where we are headed, I think. 

Senator Akaka. When you say general licenses, I wonder wheth- 
er that would mean you may have less what you may call “specific 
licenses.” 

Mr. McGaffigan. We have general licenses for things that we 
think are safe. The amount of material in the home smoke detector 
is about one-millionth of a curie of Americium. We worry down to 
ten-billionths of a curie of Americium. That is where the threshold 
is for certain reporting requirements, but despite the reporting re- 
quirements, you absolutely do not have to worry about such small 
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quantities being useful in a dirty bomb. So we expect smoke detec- 
tors which are designed to our specs to be safe for your use in the 
home. We expect the exit signs that contain tritium around here, 
they have about 10 curies of tritium in them. That sounds like a 
lot since we have been talking about micro- and millicuries, but 
you really need about 500,000 or a million curies of tritium to have 
any sort of dangerous quantity. And you still cannot do an RDD be- 
cause tritium is heavy hydrogen that rises rapidly. It would be like 
a hydrogen balloon. I hope al-Qaeda is working on tritium RDDs, 
because it will be a great day, you will see a lot of balloons go up 
in the air, I guess. 

There is a rationality to what we do, where the thresholds are 
for these various radionuclides and where we feel it is safe for use 
in the home or use in the Capitol or wherever, and where addi- 
tional controls are necessary, that is where we specifically license. 

Senator Akaka. Mr. Commissioner, I would like to ask a question 
that is not about how well NRC regulates who can buy a radio- 
active source, but about material that is even more accessible to 
terrorists, and that is lost or abandoned radioactive sources. And 
you mentioned there was a problem about these lost sources. 

In an August 2003 report, the GAO said that the NRC did not 
have a good record of how many sources were being used around 
the country because at that time no State or Federal agency 
tracked individual sealed sources. Instead, NRC and the Agree- 
ment States tracked numbers of specific licensees. 

Mr. McGaffigan. Right. 

Senator Akaka. However, in November 2006, NRC issued its 
final rule regarding establishment of a National Source Tracking 
System, a web-based system to enhance accountability for radio- 
active sources and provide a means for licensees to report the 
transfers of nationally tracked sources. 

What about sources that were being used prior to the establish- 
ment of the NSTS? How does the NSTS help the NRC Agreement 
States that the lost or abandoned radioactive sources may be sit- 
ting in, in an abandoned building or hospital, on the back of a sto- 
len truck, or laying in an open field for anyone to pick up? So how 
does this work? 

Mr. McGaffigan. Sir, we have had since 2003 an interim data- 
base of Category 1 and 2 sources that has gotten better and better 
each year. We used it during the hurricanes in 2005 in Louisiana, 
and it was very helpful to us and highly accurate in terms of where 
Category 1 and 2 sources were. So the high-risk sources, we think 
we know where they are, even if they are sitting in a university 
and not being used at the moment. 

As somebody mentioned earlier, the Department of Energy is 
now very aggressively trying to gather sources of any category that 
people no longer want. What NRC did before September 11, 2001 — 
thanks to Greta Dicus, one of our previous Commissioners — we 
have jacked the fines up so that it is more expensive to pay our 
fines than to properly dispose of the source. Abandoning a small 
source can be a very expensive proposition. The classic case was in 
a steel mill, which would get contaminated because a small source 
would come in with a lot of other scrap. 
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So we first tightened that, but then — and we were trying to make 
the responsibility be the licensees, the people who had these small 
sources, make them pay for the proper disposition. There are a lot 
of companies who will take them back. But we have pretty much 
abandoned that now, and DOE will pay for getting anybody’s 
sources back from them, and that is a post-September 11 change. 
And DOE does a very good job of it, in my view, their orphan 
source recovery program. We had some old sources left in even high 
schools that were sitting in closets, and this high school just could 
not justify sending it to J.L. Shepherd in California for whatever 
price J.L. Shepherd would charge them from taking the source off 
their hands. So they beat us, they outwaited us, and they now get 
DOE to do it for free. That is probably the right thing in a post- 
September 11 world. We may have been trying to put responsibility 
where responsibility has been shirked before September 11. After 
September 11, we put the responsibility on government. If you 
have a source you want to have recovered, DOE prioritizes it. We 
help them find them. The Agreement States help them find them. 
And I think the quantity of orphan sources in this country has 
gone down a very large amount because of DOE. It is only because 
we do not know about it that an orphan source would be sitting out 
there nowadays. 

Senator Akaka. Commissioner McGaffigan, I want to thank you 
so much for all of your responses and your patience here. I also 
want to thank Senator Coleman for his patience here. Do you have 
any further questions? 

Senator Coleman. I have nothing further, Mr. Chairman. 

Senator Akaka. Well, I have other questions that I will submit 
for the record. I just want to note that the record will stay open 
for 15 days for questions for the record, and this Permanent Sub- 
committee on Investigations of the full Committee on Homeland 
Security and Governmental Affairs is now considered adjourned. 

[Whereupon, at 11:18 a.m., the Subcommittee was adjourned.] 
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GAO also attempted to obtain a license from an agreement state, but 
withdrew the application after state license examiners indicated they would 
visit the bogus company office before granting the license. An official with 
the licensing progrmn told GAO that conducting a site visit is a standard 
required procedure before radioactive materials license applications are 
approved in that state. 

As a result of this investigation, NRC suspended its licensing program until it 
could determine wliat corrective actions w'ere necessary to resolve the 
weaknesses GAO identified. On June 12, 2007, NRC issued supplemental 
interim guidance with additional screening criteria. These criteria are 
intended to help a license examiner determine whether a site visit or face-to- 
face meeting with new license applicants is required. 

, , — United States Government Accountability Office 
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Mr. Chairman and Members of the Subcommittee; 

Thank you for the opportunity to discuss our covert testing of the Nuclear 
Regulatory Commi^ion’s (NRC) licensing process for sealed radioactive 
sources. Under the Atomic Energy Act of 1954, NRC regulates domestic 
medical, industrial, and research uses of sealed radioactive sources 
through a combination of regulatory requirements, licensing, inspection, 
and enforcement. Organizations or individuals attempting to purchase a 
sealed source must apply for a license and gain the approval of either NRC 
or an "agreement state.” To become an agreement state, a state must first 
demonstrate to NRC that its regulatory program is compatible with NRC 
regulations and is effective in protecting public health and safety. Through 
an agreement between NRC and the state governor, NRC then transfers 
portions of its regulatory and licensing authority to the state. According to 
NRC, there are approximately 22,000 licenses in the United States — NRC 
administers about 4,400 licenses, and the rest are administered by 
regulatory authorities in the 34 agreement states. 

Given that terrorists have expressed an interest in obtaining nuclear 
material, the Congress and the American people expect licensing 
programs for these materials to be secure. However, in 2003, we reported 
that weaknesses in the licensing program could allow terrorists to obtain 
radioactive materials. We recommended that NRC close this vulnerability 
by modifying its licensing process.' Among other things, we recommended 
that “NRC modify its process for issuing specific licenses to ensure that 
sealed radioactive sources cannot be purchased before NRC's 
verification — through inspection or other means — that the materials will 
be used as intended.” NRC agreed with this recommendation and referred 
the issue to a working group composed of NRC and state representatives 
to coordinate NRC’s response. In December 2005, the working group 
delivered its recommendations to NRC senior management. In December 
2006, NRC issued new guidance to agreement states and NRC regional 
offices meant to strengthen the radioactive materials licensing process.'^ 
Although these are important steps forward, the Subcommittee remained 
concerned about whether, almost 6 years after September 1 1 , 200 1 , 


'GAO, Nucimr Security: Federal and State Action Needed to Imptvve Security of Sealed 
Radioactive Sources. GAO-03-804 (Washington, D.C.: Aiig. 6, 2003). 

guidance was also sent to officials in New Jersey, Penmylvania, and Virginia — states 
that not yet agreement states but have filed statements of intent with NRC to achieve 
agreement state status. 
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terrorists could still exploit weaknesses in the government’s licensing 
process and obt^n radioactive material. To determine whether NRC 
actions to address our 2<K)3 recommendations were sufficient, the 
Subcommittee asked us to use covert investigative methods to test the 
licensing program. 

To perform this investigation, we incorporated two bogus businesses — 
one in a non-agreement state and one in an agreement state. We selected 
these two states based on their proximity to the Washington, D.C., metro 
area. Using the names of the bogus businesses, we then prepared and 
submitted one application for a byproduct materials license to NRC and a 
second application to the department of the environment of the agreement 
state. In creating these applications, we only used publicly available 
information. Our investigators did not actually purchase radioactive 
materials for several reasons — first, the primary intent of our work was to 
test the licensing process rather than the purchasing process; second, we 
did not think the cost borne by the government would be necessary to 
prove the point of our work; and third, we did not have the proper 
facilities to safely store the radioactive materials. In performing research 
for this work, we reviewed our previous reports on nuclear security and 
learned about the licensing process from NRC’s Web site. We altered the 
license we received from NRC, which enabled us to obtain agreements to 
purchase more radioactive material than the original license permitted. We 
conducted our investigative work from October 2006 through June 2007 in 
accordance with standards prescribed by the President’s Council on 
Integrity and Efficiency. 

In summary, we found the following: 

• The license application we submitted to NRC was approved. We 
received a license in the mail from NRC about 4 weeks after submitting 
the application. Aside from traveling to a non-agreement state to pick 
up and send mail, our investigators did not need to leave their office in 
Washington, D.C., to obtain the license from NRC. Further, other than 
obtaining radiation safety officer training, investigators gathered all the 
information they needed for the license from the NRC Web site. 

• After obtaining a license from NRC, we sought to purchase, from two 
U.S. suppliers, machines containing sealed radioactive material. Our 
letters of intent to purchase, which included an altered version of the 
NRC license as an attachment, were accepted by the suppliers. These 
suppliers gave us price quotes and commitments to ship the machines 
containing radioactive materials. The amount of radioactive material 
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we could have ju^quired from these two suppliers was sufficient to 
reach the International Atomic Energy Agency’s (IAEA) definition of 
category 3. According to IAEA, category 3 sources are dangerous if not 
safely managed or securely protected and “could cause permanent 
iryury to a person who handled them, or was otherwise in contact with 
them, for some hours. It could possibly — although it is unlikely — be 
fatal to be close to this amount of unshielded radioactive material for a 
period of days to weeks. Importantly, with patience and the proper 
financial r^ources, we could have accumulated from other suppliers 
substantially more radioactive source material than what the two 
suppliers initially agreed to ship to us. 

We withdrew our second application from the agreement state 
department of the environment after license examiners indicated they 
would visit our company office before granting the license. Since we 
did not have a company office or the proper storage equipment, we 
asked the state to withdraw our application to obtain a license in this 
stale. According to an official with the licensing program for this state, 
the completion of a site visit is a standard procedure before the state 
department of the environment approves a radioactive materials 
license application. 


Background 


Since the September 11, 2001, terrorist attacks there has been concern that 
cenain radioactive material could be used in the construction of a 
radiological dispersion device (RDD). An ROD disperses radioactive 
material over a particular target area, which could be accomplished using 
explosives or by other means.^ The major purpose of an RDD would be to 
create terror and disruption, not death or destruction. Depending on the 
type, form, amount, and concentration of radioactive material used, direct 
radiation exposure from an RDD could cause health effects to individuals 
in proximity to the material for an extended time; for those exposed for 
shorter periods and at lower levels, it could potentially increase the long- 


^nternationaJ Atomic Energy Agency, Code of Conduct on the Safety and Security qf 
Radioactive Sources (Vienna, Austria: 2004). 

’According to NRC, a dirty bomb is one type of RDD that combines a conventional 
explosive, such as dynamite, with radioactive material. The terms dirty bomb and RDD are 
often used interchangeably in the media. Most HDDs would not release enou^ radiation to 
kill people or cause severe illness — the conventional explosive itself could be more 
harmful to individuals than the radioactive material. However, depending on the scenario, 
an RDD explosion could cresde fear and panic, contaminate property, and require 
potentially costly cleanup. 
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term risks of cancer. In addition, the evacuation and cleanup of 
contaminated areas after dispersal could lead to panic and serious 
economic costs on the affected population. In 2003, a joint 
NRC/Department of Energy (DOE) interagency working group identified 
several radioactive materials (including Americium-241 and Cesium-i37) 
as materials at higher risk of being used in an RDD, describing these as 
“materials of greatest concern.”® 

In its risk-based ^proach to securing radioactive sources, NRC has made 
a commitment to work toward implementing the provisions of IAEA’s 
Code of Conduct. This document provides a framework that categorizes 
the relative risk associated with radioactive sources.® While NRC has 
recently focused on upgrading its capacity to track, monitor, and secure 
category 1 and 2 sources, which are considered high risk, category 3 
sources are not a primary focus of NRC regulatory efforts. Category 3 
sources include byproduct material, which is radioactive material 
generated by a nuclear reactor, and can be found in equipment that has 
medical, academic, and industrial applications. For example, a standard 
type of moisture gauge used by many construction companies contains 
small amounts of Americium-241 and Cesium-lS?, According to NRC, it 
would take 16 curies of Americiura-241 to constitute a high-risk category 2 
quantity, and 1.6 curies of Americium-241 is considered a category 3 
quantity. 


Results of 
Investigation 


In October and November 2006, using fictitious names, our investigators 
created two bogus companies — one in an agreement state and one in a 
non-agreement state. After the bogus businesses were incorporated, our 
investigators prepared and submitted applications for a byproduct 
materials license to both NRC and the department of the environment for 
the selected agreement state. The applications, mailed in February 2007, 


The DOE/NRC Interagency Working Group on Radiological Dispersal Devices, 
Radiological Dispersal Devices: An Initial Study to Identify Radioactive Materials of 
Greatest Concern and Approaches to Their Tracking, Tagging, and Disposition 
(Wa.shington, D.C.; 2003). 

®NRC has endorsed the IAEA Code of Conduct and is working toward the implementation 
of its various provisions. On November 8, 20(^| NRC issued a rule to require iicensees to 
report infoimation on the manufacture, transfer, njceipt, disassembly, and disposal of all 
category I and 2 sources throughout their entire life cycle in the National Source Tracking 
System {NST3). NEC’s late^ estimate is that the NSTS will be operational in May 2008. 
NRC told us tluat it has plans to consider including category 3 sources in the NSTS after the 
system becomes oper^ional. 
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were identical except for minor differences resulting from variations in the 
application forms. Using fictitious identities, one investigator represented 
himself as the company president in the applications, and another 
investigator represented himself as the radiation safety officer. The license 
applications stated that our company intended to purchase machines with 
sealed radioactive sources. 

According to NRC guidance finalized in November 2006 and sent to 
agreement states in December 2006, both NRC and agreement state license 
examiners should consider 12 screening criteria to verify that radioactive 
materials will be used as intended by a new applicant.’ For example, one 
criterion suggests that the license examiner perform an Internet search 
using common search engines to confirm that an applicant company 
appears to be a legitimate business that would require a specific license. 
Another screening technique calls for the license examiner to contact a 
state agency to confirm that the applicant has been registered as a 
legitimate business entity in that state. If the examiner believes there is no 
reason to be suspicious, he or she is not required to take the steps 
suggested in tlie screening criteria and may indicate “no” or “not 
applicable" for each criteria. If the license examiner takes additional steps 
to evaluate a criterion, he or she should indicate what publicly available 
information was considered. If there is concern for a potential security 
risk, the guidance instructs license examiners to note the basis for that 
concern. 


Application to NRC Nine days after mailing their application form to NRC, our investigators 

received a call from an NRC license examiner. The NRC license examiner 
stated that the application was deficient in some areas and explained the 
necessary corrections. For example, the license examiner asked our 
investigators to certify that the machines containing sealed radioactive 
source material, which are typically used at construction sites, would be 
returned to the company office before being transported to a new 
construction site. The license examiner explained that this was a standard 
security precaution. Even though we did not have a company office or a 
construction site, our investigators nevertheless certified their intent to 
bring the machines back to their office before sending them to a new 
location. They made this certification via a letter faxed to NRC. Four days 


'Nuclear Regulz^ry Commission, Checklist to Ensure that Radioactive Materials Will Be 
Used As Intended. NUREG-1556, VoJ. 20. C (Washington, D.C.: Nov, 2006). 
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after our final correcUon to the license application, NRC approved our 
application and mailed the license to the bogus business in the non- 
agreement state. It took a total of 4 weeks to obtain the license. See figure 
1 for the fiist page of the transmittal letter we received from NRC with our 
license. 


Figure 1 : Excerpt from NRC License Acceptance Letter for Bogus Business 



The NRC license is printed on standard 8-1/2 x 11 inch paper and contains 
a color NRC seal for a watermark. It does not appear to have any features 
that would prevent physical counterfeiting. We therefore concluded that 
wc could alter the license without raising the suspicion of a supplier. We 
altered the license so that it appeared our bogus company could purchase 
an unrestricted quantity of sealed source materials rather than the small 
amounts of Ainericium-241 and Cesium-137 listed on the original license. 
We determined the proper language for the license by reviewing publicly 
available information. 

Next, we contacted two U.S. suppliers of the machines specified in our 
license. We requested price quotes and faxed the altered license to the 
suppliers as proof that we were certified to purchase the machines. Both 
suppliers offered to sell us the machines and provided us price quotes. 
One of these suppliers offered to provide twice as many machines as we 
requested and offered a discount for volume purchases. In a later 
telephone call to one of the suppliers, a representative of the supplier told 
us that his company does not check with NRC to confirm the terms listed 
on the licenses that potential customers fax them. He said that his 
company checks to see whether a copy of the front page of the license is 
faxed with the intent to purchase and whether the requested order 
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exceeds the maximum allowable quantity a licensee is allowed to possess 
at any one time. 

Although we had no legitimate use for the machines, our investigators 
received, wdthin days of obtaining a license from NRC, price quotes and 
terms of payment that would have allowed us to purchase numerous 
machines containing sealed radioactive source materials. These purchases 
would have substantially exceeded the limit that NRC approved for our 
bogus company. If these radioactive materials were unsealed and 
aggregated together, the machines would yield an amount of 
Americium-241 that exceeds the threshold for category 3 materials. 

As discussed previously, according to IAEA, category 3 sources are 
dangerous if not safely managed or securely protected and “could cause 
permanent iqiury to a person who handled them, or was otherwise in 
contact with them, for some houm. It could possibly — although it is 
unlikely — be fatal to be close to this amount of unshielded radioactive 
material for a period of days to weeks.” Importantly, with patience and the 
proper financial resources, we could have accumulated, from other 
suppliers, substantially more radioactive source material than what the 
two suppliers initially agreed to ship to us — potentially enough to reach 
category 2. According to IAEA, category 2 sources, if not safely managed 
or securely protected, "could cause permanent injury to a person for a 
short time (minutes to hours), and it could possibly be fatal to be close to 
this amount of unshielded material for a period of hours to days." 


Application to the Ten days after mailing their application form to the agreement state’s 

Agreement State department of environment, our investigators received a call from a 

department license examiner. The license examiner stated that the 
application was deficient in some areas and said that she would send us a 
letter outlining what additional information the state required before 
approving the license. The examiner further stated that before the license 
was granted, she would conduct a site visit to inspect the company office 
and storage facilities cited in our application. Our investigators 
subsequently decided not to pursue the license in this state and requested 
that their application be withdrawn. According to an official in the 
department of environment for this state, the license examiner followed 
the required state procedure in requesting a site visit. The official told us 
that as a matter of long-standing state policy, license examiners in this 
state conduct site visits and interview company management (especially 
radiation safety officers) before granting new licenses for radioactive 
materials. This state policy is more stringent than the guidance NRC 
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Corrective Action 
Briefing 


provided agreement states in December 2006. The NRC guidance identified 
a site visit as one po^ible screening criterion to use in evaluating a new 
license application, but, as discussed above, a site visit is not required 
under the NRC guidance. 


On June 1, 2CH)7, we contacted NRC and discussed the results of our work. 
An NRC official indicated that NRC would take immediate action to 
address the weaknesses we identified. After this meeting, we learned that 
NRC suspended its licensing program for specific licenses until it could 
determine what corrective actions were necessary to resolve the 
weaknesses. NRC also held a teleconference with a m^ority of the 34 
agreement states to discuss our work. On June 12, 2007, NRC issued 
supplemental interim guidance with additional screening criteria. These 
criteria are intended to help a license examiner determine whether a site 
visit or face-to-face meeting with new license applicants is required. NRC 
told us that it planned to convene a working group to develop improved 
guidance addressing the weaknesses we identified. 


Conclusions and NRC‘s goal is to provide licenses to only those entities that can 

demonstrate that they have legitimate uses for radioactive materials. 
Recommendations for However, our work shows that there continues to be weaknesses in the 
Executive Action process NRC uses to approve license applications. In our view, a routine 

visit by NRC staff to the site of our bogus business would have been 
enough to reveal our lack of facilities and equipment. Purthermore, if NRC 
license examiners had conducted even a minimal amount of screening — 
such as performing common Web searches or making telephone calls to 
local government or business offices — they would have developed serious 
doubts about our application. Once we received our license, the ease with 
which we were able to alter the license and obtain price quotes and 
commitments to ship from suppliers of radioactive materials is also cause 
for concern. Accordingly, we are making the following tliree 
recommendations to the Chairman of the NRC: 

• Firet, to avoid inadvertently allowing a malevolent individual or group 
to obtain a liceUvSe for radioactive materials, NRC should develop 
improved guidance for examining NRC license applications. In 
developing improved screening criteria, NRC should consider whether 
site visits to new licensees should be mandatory. These improved 
screening criteria will allow NRC to provide reasonable assurance that 
licenses for radioactive materials will only be issued to those with 
legitimate uses. 
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Second, NRC should conduct periodic oversight of license application 
examiners so that NRC will be assured that any new guidance is being 
appropriately applied. 

Third, NRC should explore options to prevent individuals from 
counterfeiting NRC licenses, especially if this allows the purchase of 
more radioactive materials than they are approved for under the terras 
of the original license. 


Mr. Chairman, this concludes our statement. We would be pleased to 
answer any questions that you or other Members of the Subcommittee 
may have at Utis time. 
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Chairman Levin, Senator Coieman, and other members of the subcommittee, I 
am here today on behalf of the Nuclear Regulatory Commission (NRC) to address the 
issues related to NRC’s materials licensing program raised in your July 2, 2007 letter to 
NRC Chairman Klein. 

BACKGROUND 


I am first going to give you some background on the 2003 international Atomic 
Energy Agency (IAEA) revised Code of Conduct on the Safety and Security of 
Radioactive Sources, and on NRC's program to tighten controls on the highest risk 
sources, consistent with the United States Government's commitment to the Code of 
Conduct. 

The Code of Conduct identifies 16 radionuclides of concern (which are listed on 
page 2 of the slides that accompany my testimony). Of these only four are widely used 
in civilian applications in this country: cobalt-60, cesium-137, iridium-192, and 
americium-241. Such civilian applications include food and medical equipment 
sterilization, medical research, cancer treatment, oil and gas exploration and non- 
destructive testing of materials. 

Pages 3 and 4 of my slides show the Code of Conduct categories for 
americium-241 and cesium-137, the radionuclides in the devices relevant to GAO’s 
investigation. Sources containing category 1 quantities of these materials are the most 
dangerous. Sources containing category 5 quantities are the least dangerous, but are 
still regulated for safety purposes by NRC above certain exempt levels. A minute 
quantity of americium-241 , about one-millionth of a curie, is used in smoke detectors. 

Since the revised Code of Conduct was issued in 2003, NRC's focus has been 
on putting in place much tighter controls on sources containing category 1 and 2 
quantities of the 16 radionuclides of concern. Page 5 outlines our import-export control 
initiatives. The United States was the first nation to issue and implement import and 
export controls consistent with the Code of Conduct recommendations. 

Pages 6 through 10, which I am not going to go through in detail, outline the 
security measures NRC has taken to date to tighten security on category 1 and 
category 2 sources. Pages 11 and 12 list future actions planned by the Commission. 
Again, NRC has almost always been the world leader in putting these much tighter 
controls in place. In all of these initiatives, however, unlike import-export control which 
is solely under NRC's authority, NRC coordinates with 34 Agreement States who, 
pursuant to agreements with NRC under section 274 of the Atomic Energy Act, control 
radioactive materials' use in their States. In Agreement States, NRC retains 
responsibility for federal licensees, such as military and veterans hospitals and Federal 
non-Department of Energy laboratories. DOE self-regulates its own laboratories. 
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Page 13 gives you the list of NRC-regulated States and Agreement States, and 
the total number of specific materials licenses in each state. Michigan is an NRC- 
regulated State. Minnesota is the newest Agreement State. 

Pages 14 and 1 5 show the total number of category 1 and category 2 sources in 
Michigan and Minnesota according to NRC’s 2006 interim data base. Nationwide there 
are approximately 1,500 licensees who possess category 1 and category 2 material as 
of 2006, less than ten percent of the 22,132 total materials licenses in the U.S. The 
ratios in Michigan and Minnesota are both below ten percent. 

With that background, and in light of the GAO’s findings, let me now address the 
four issues raised in Chairman Levin’s and Ranking Minority Member Coleman’s July 2 
letter to Chairman Klein, 

NRC POLICIES AND PROCEDURES ON ISSUANCE OF MATERIALS LICENSES 


First, let me outline NRC’s policies and procedures on issuance of materials 
licenses. NRC has very prescriptive rules on such licensing in Parts 30 to 39 of Title 10 
of the Code of Federal Regulations. The 34 Agreement States each have adopted 
compatible, but not always identical, regulations. After September 1 1 , 2001 , the 
pre-Code of Conduct regulations were augmented to tighten controls on category 1 and 
category 2 sources first by voluntary compliance with security advisories and, later, by 
mandatory compliance with Orders or other binding license conditions. I summarized 
these additional controls on pages 6 to 10 of my slides. The Commission believes that 
we and the Agreement States have taken a risk-informed approach to these controls, 
that is we have worked on the highest risk categories of licensees first before turning to 
lower risk categories. In doing so, we believe we have allocated resources to maximize 
security benefits. 

Every new applicant seeking to possess category 1 or 2 material is very 
thoroughly vetted both by NRC and the Agreement States, including pre-licensing site 
visits, issuance of Orders or binding license conditions required to implement the 
enhanced security measures prior to receiving the material, and post-licensing 
inspections within 12 months of license issuance. 

However, new applicants for category 3 and below material do not face the same 
degree of scrutiny, as GAO identified. NRC and Agreement State licensing officers 
were allowed to exercise judgment on pre-licensing site visits based on five factors 
specified in the November 2006 guidance referred to on page 10. Post-licensing 
inspections would in all cases occur within 12 months of license issuance. 
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VULNERABILITY OF NRC AND AGREEMENT STATE MATERIALS LICENSES TO 
MODIFICATION OR COUNTERFEITING 


GAO’S most recent report has raised issues about the adequacy of these 
procedures because of their ability to obtain and modify an NRC license issued to a 
fake West Virginia firm. The NRC license as issued in March 2007 would have limited 
the firm to purchasing four or five moisture density gauges with the total radionuclide 
content approximately in the middle of category 4 for americium-241 and near the 
bottom of category 4 for cesium-137. These devices are used, for example, to look for 
voids in asphalt pavements. Each gauge costs about $5,000. An example is shown on 
page 16 of my slides. 

However, GAO was able to alter the license to get bids for more than ten times 
the original license's limits on possession of americium-241. This would have given the 
GAO firm a total amount of americium-241 near the low end of category 3. A similar 
attempt by GAO to carry out the same sting in Maryland, an Agreement State, was 
thwarted by the Maryland licensing officer’s decision to conduct a pre-application site 
visit, at which point GAO withdrew the application. 

NRC appreciates GAO bringing their findings to our attention on June 1 , 2007. 
Clearly, GAO's findings have brought into question the effectiveness of our November 
2006 guidance and are a cause for concern. GAO's findings also reinforce findings 
from an NRC Inspector General audit (OIG-07-A-12) of the agency's materials 
regulatory process, completed in March 2007. 

REMEDIAL MEASURES NRC HAS IMPLEMENTED OR PLANS TO IMPLEMENT IN 
RESPONSE TO THE EXPOSED WEAKNESSES IN THE NRC MATERIALS LICENSE 
APPLICATION PROCESS 


NRC acted promptly to address the vulnerabilities in NRC’s licensing process 
identified by GAO, initiating both short-term and long-term actions. Short-term actions 
were as follows: 

• We immediately informed our Federal partners and the Agreement States 
of GAO’s findings. 

• Within 24 hours, we suspended issuance of all new materials licenses for 
about two weeks, pending issuance of revised interim procedures to 
address the GAO concerns. 

• In mid-June, we issued revised interim procedures which require on-site 
inspections or in-office meetings with new materials license applicants. 
Exceptions may be made for applicants who already possess, or are listed 
on, an NRC or Agreement State license. 

In addition, we initiated the following longer-term actions: 

• Performing a retrospective examination of certain licenses issued by the 
NRC to verify that the licensees are legitimate. 
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• Re-evaluating our licensing procedures and guidance, and considering 
long-term solutions to the issues of falsification of identity and 
unauthorized alteration of license documents. 

• Coordinating with the 34 Agreement States to ensure that security 
enhancements are implemented nation-wide. 

• Re-evaluating our training and oversight procedures for NRC license 
reviewers and Agreement State programs to ensure that new security 
measures are effectively implemented. 

• Evaluating how to probe for other thus far undiscovered vulnerabilities in 
NRC and Agreement State materials licensing programs. 

NRC RESPONSIVENESS TO PRIOR GAO RECOMMENDATIONS REGARDING 
MATERIALS LICENSING PROCEDURES 


Since GAO's 2007 investigation was meant to verify whether NRC and 
Agreement State actions in response to recommendation 3 of a 2003 GAO report 
{GAO-03-804) on security of radioactive sources were effective, the obvious question 
arises as to whether NRC did enough before closing its response to that 
recommendation In April 2006. Recommendation 3 was that NRC's licensing process 
should be modified to ensure that sealed sources cannot be purchased before NRC’s 
verification, through inspection or other means, that the material will be used as 
intended. 

NRC's response, coordinated with the Agreement States, made the distinction 
between category 1 and category 2 applicants and category 3 and category 4 
applicants, which I discussed earlier, based on our judgment of risks and optimal 
allocation of resources. NRC believed that these revised procedures adequately 
addressed GAO's 2003 recommendation. 

In hindsight NRC missed the vulnerabilities in our licensing process identified by 
GAO, that resulted in a seemingly legitimate licensee obtaining a license for a small 
amount of material, then falsifying the license and potentially aggregating a much 
greater amount of material. Our primary focus on the control of category 1 and 
category 2 material under our risk-informed approach perhaps resulted in our not 
sufficiently probing vulnerabilities in our materials licensing system. 

NRC is committed to continuous improvements in our regulatory programs. We 
will implement the long-term actions in response to GAO's latest findings which I 
outlined earlier, and we will keep GAO and the Congress informed about our actions. 

CONCLUSION 


The Commission takes this issue very seriously. We will continue to move 
forward to address it, and we will implement new procedures as required to improve the 
security of radiological sources. GAO may have found a unique vulnerability, or there 
may be more left for us to discover. We intend to find out. Thank you, and I look 
forward to answering your questions. 
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I. INTRODUCTION 

Since 2003, the U.S. Senate Permanent Subcommittee on 
Investigations (Subcommittee) has engaged in a bipartisan investigation 
into U.S. Government efforts to prevent a nuclear or radiological attack 
on U.S. interests. The Subcommittee’s efforts have included oversight 
investigations into U.S. port security and global supply chain security.' 
In addition, the Subcommittee has, with the assistance of the U.S. 
Government Accountability Office (GAO), probed certain 
vulnerabilities in the U.S. Government’s practices and procedures for 
issuing licenses to possess radioactive materials. This report is another 
component in that effort, examining certain vulnerabilities in U.S. 
regulation of radioactive materials and whether America’s enemies 
could exploit those weaknesses to develop a so-called “dirty bomb.”^ 
Finally, this report presents certain recommendations to remedy those 
vulnerabilities. 

II. EXECUTIVE SUMMARY 

Dirty bombs pose an ongoing terrorist threat that the United States 
must be prepared to counter. The Executive Director of the 9/11 
Commission stated in 2004 that al-Qaeda “remains interested in using a 
radiological dispersal device or ‘dirty bomb.’ ... Documents found in 
al-Qaeda facilities contain accurate information on the usage and impact 
of such weapons.’’^ Similarly, in September 2006, then-leader of al- 


* The Subcommittee’s investigation into these security matters has featured a series of 
hearings including a May 2005 hearing entitled '‘"The Container Security Initiative and The 
Customs-Trade Partnership Against Terrorism: Securing the Global Supply Chain or Trojan 
Horse?" In March 2006, the Subcommittee held a two-day hearing entitled Neutralizing the 
Nuclear and Radiological Threat: Securing the Global Supply Chain, in conjunction with that 
hearing, the Subcommittee released a bipartisan report, entitled An Assessment of U.S. Efforts to 
Secure the Global Supply Chains which provided a detailed assessment of numerous port security 
and global supply chain security programs. See http://w\^w.hsgac.senate.aov/index.cfm?Fuseaction 
=Hearings.Dctail&HearinplD=336 and hHp://ww\v. hsgac, senate. gov/index.ctm?Fuseaction=IIearings. 
Detail&HearingID=335 . 

2 

The U.S. Nuclear Regulatory Commission defines a “dirty bomb” as follows: A “dirty 
bomb” is one type of a “radiological dispersal device” (RDD) that combines a conventional 
explosive, such as dynamite, with radioactive material The terms dirty bomb and RDD are often 
used interchangeably in the media. Most RDDs would not release enough radiation to kill 
people or cause severe illness - the conventional explosive itself would be more harmful to 
individuals than the radioactive material However, depending on the scenario, a RDD explosion 
could create fear and panic, contaminate property, and require potentially costly cleanup. See 
NRC Fact Sheet on Dirty Bombs at http://www.nrc.gov/reading-im/doc-collectiQns/fact- 
shcets/dirtv-bombs.html . While the NRC states that a nuclear bomb would be a “Weapon of 
Mass Destruction,” it indicates that a dirty bomb is a “Weapon of Mass Disruption,” in which 
“contamination and anxiety are the terrorists’ major objectives.” See id. 

^ See Statement of Dr. Philip D. Zelikow, Executive Director of the National Commission 
on Terrorist Attacks Upon the United States, June 16, 2004; Staff Statement No. 15, Overview of 
the Enemy, National Commission on Terrorist Attacks Upon the United States, June 16, 2004; 
http://www.9-l lcommission.gov/hcarings/hearingl2.htm . 
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Qaeda in Iraq, Abu Hamza al-Muhajir was reported to have called for 
“nuclear scientists and explosive experts” to help his terrorist group 
manufacture “unconventional weapons, whether biological or dirty, as 
they call them.”'’ Likewise, would-be terrorists arrested in London in 
August 2004 reportedly sought to construct “a crude radiological dirty 
bomb.”= 

In light of this threat, regulation and tracking of radioactive 
materials have become more important than ever. ® This report explores 
some fundamental gaps in the Federal Government’s regulation of 
radioactive materials, in particular, vulnerabilities in the procedures 
employed by the U.S. Nuclear Regulatory Commission (NRC) to 
administer licenses for such materials. These vulnerabilities were 
exposed when the GAO, at the request of this Subcommittee, conducted 
a clandestine operation to create a dummy corporation and obtain a valid 
NRC materials license to purchase certain nuclear materials. After a 
cursory review, the NRC issued the materials license to GAO’s dummy 
corporation in just 28 days. 

Additional weaknesses were identified when the GAO was able to 
counterfeit the NRC license - using publicly available, off-the-shelf 
computer software - to remove restrictions on the quantity of radioactive 
materials permitted under the license. GAO investigators then used the 
counterfeited licenses to execute contracts to buy enough radioactive 
materials to meet the NRC’s definition of a “dangerous” quantity - 
enough to build a dirty bomb. Perhaps more importantly, investigators 
reported that they could have easily prolonged their effort, generating 
dozens of fake licenses, visiting multiple suppliers, and stockpiling 
significantly higher amounts of this (and potentially more radioactive) 
material. The GAO states that it could have purchased “substantially 
more radioactive source material,” possibly enough to reach the 
threshold of a “very dangerous” quantity. In other words, the modest 
amount of radioactive materials that the GAO sought to purchase was 


4 

See David Rising, Associated Press, “^/ Qaeda in Iraq Beckons Nuclear Scientists," 
September 29, 2006 (“The fugitive terrorist chief said experts in the fields of ‘chemistry, physics, 
electronics, media and all other sciences - especially nuclear scientists and explosives experts’ 
should join his group's jihad, or holy war, against the West. ‘We are in dire need of you,’ said 
the speaker. ‘The field of jihad can satisfy your scientific ambitions, and the large American 
bases [in Iraq] are good places to test your unconventional weapons, whether biological or dirty, 
as they call them.’”). 

^ See Adam Zagorin and Elaine Shannon, Time Magazine, ^"London's Dirty-Bomb Plot," 
October 3, 2004, htt p://wu^.timc.com/time/niagazine/article/Q.91 71 .1 1 01Q41Q1 1 708959.00. 
htnil 

^ The term “radioactivity” denotes the spontaneous disintegration of an unstable atomic 
nucleus, resulting in the emission of helium nuclei (called alpha particles), electrons (called beta 
particles), and/or gamma rays (high-energy x-rays). See NRC Glossary at 
httD://www.nrc.gov/rcading-i7n/basic-ref/2lossarv . 
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but a demonstration amount, and it could have been considerably larger 
and considerably more dangerous. 

The weaknesses in NRC licensing procedures are not new. In fact, 
as described in this report, several entities - including the GAO, the 
NRC Inspector General, and this Subcommittee - have recommended 
over the past 4 years that the NRC improve its licensing procedures to 
ensure that radioactive materials will be used as intended. To its credit, 
the NRC has recently shown a willingness to strengthen its licensing 
process, including making changes in June 2007 as a response to the 
GAO’s latest clandestine operation. Those recently-adopted changes are 
reviewed below, along with several recommendations designed to 
improve NRC regulation even further. 

Based upon its investigation, the Subcommittee staff makes the 
following recommendations: 

■ The NRC should reevaluate the apparent good-faith 
presumption that pervades its licensing process. 

■■ The NRC should regulate Category 3 sources more 
stringently. Specifically, the NRC should (i) physically 
inspect applicants’ facilities before the issuance of a 
Category 3 materials license, and (ii) consider including 
Category 3 sources in the proposed National Source Tracking 
System. 

■■ The NRC should act quickly to establish a web-based 
licensing system to ensure that source materials can be 
obtained only in authorized amounts by legitimate users. 

These recommendations are designed to bolster the NRC’s ability to 
prevent radioactive materials from being acquired to create a dirty bomb. 

III. BACKGROUND 

A. Radioactive Materials 

Radioactive materials play a vital role in American medicine, 
research, and industry. Such radioactive materials, which are generally 
called “sealed sources,” are 
used for a wide array of 
purposes throughout the 
United States. In medicine, 
for example, sealed sources 
help to diagnose injuries, treat 
cancer, and sterilize medical 
devices. Similarly, sealed 
sources are used to irradiate 
food, to detect flaws in metal 
welds, to determine the 


What is a “Skai.ed Soi rc e”? 

The term “scaled source” is important in 
the radiological community. The NRC 
defines a sealed source as "any radioactive 
material or byproduct encased in a sealed 
metal or plastic capsule to prevent 
leakage.” Scaled sources may be as small 
as a coin or contained in machines as large 
as an SUV. Under normal conditions, 
sealed sources present an insignificant 
contamination hazard but can be 
dangerous if exposed. 
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density of a variety of materials, and to detect the presence of minerals 
miles below the Earth’s surface. 

B. The NRC And Agreement States 

The Atomic Energy Act of 1954 authorizes the NRC to regulate 
the possession and use of sealed sources through regulatory 
requirements, licensing, inspection, and enforcement.’ Section 274 of 
the Act authorizes the NRC to relinquish this authority, for purposes of 
health and safety, to States that agree to regulate their residents’ use of 
sealed sources. States that enter such contracts with the NRC are 
commonly called “Agreement States.” To qualify, “the States must first 
demonstrate that their regulatory programs are compatible with NRC’s 
program and adequate to protect public health and safety.”* After 
entering into an agreement with the NRC, the respective States then 
become responsible for regulating the possession and use of radioactive 
materials within their borders. The NRC periodically evaluates the 
Agreement States’ programs to ensure that they remain compatible with 
NRC regulations and are generally effective in protecting health and 
public safety.’ 



Map Reflecting 34 Agreement States (in dark shading) and 16 Non- 
Agreement States (in light shading) 


There are currently 34 Agreement States, as reflected in the figure 
above.'® For the 16 remaining non-agreement States, as well as the 


’ See 42 U.S.C. Section 2021 et seq. 

^ See NRC Office of the Inspector General, Summary! Report and Perspectives on 
Byproduct Material Security and Control, OIG-07~A-12, March 30, 2007 (the “NRC Inspector 
General March 2007 Report”). 

9 

See GAO, Nuclear Security: Federal and State Action Needed to Improve Security of 
Sealed Radioactive Sources, GAO-03-804, August 6, 2003 (the “GAO August 2003 Report”). 

'® According to the Organization of Agreement States, three additional States (New 
Jersey, Pennsylvania, and Virginia) have begun the process of becoming Agreement States. See 
httD://www.agreementstate5.org . 
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District of Columbia, the Commonwealth of Puerto Rico, and various 
territories of the United States, the NRC itself regulates the use of sealed 
sources. 

C. The Category System And Its Limitations 

The NRC classifies radioactive materials using a scale from 1 
through 5 according to the source’s immediate or near-immediate effects 
on human health. This categorization regime is based in large measure 
on the International Atomic Energy Agency (IAEA) Code of Conduct on 
the Safety and Security of Radioactive Sources." The code of conduct 
contains basic principles necessary for the safe and secure use of 
radioactive materials. 

Under this regime. Category 1 sources are considered the most 
dangerous and Category 5 sources are considered the least dangerous. 
Categories 1 and 2, the most dangerous materials, receive the most 
stringent security and safety requirements. Category 3, while still 
considered “dangerous” by the IAEA and the NRC, is subject to much 
more lenient measures. Categories 4 and 5, in turn, are subject to even 
fewer requirements. For example, a 10-microcurie quantity of cesium- 
137, an amount unlikely to harm anyone, falls under Category 5 and 
would be exempt from licensing requirements.'^ In contrast, 3,000 
curies of the same material, which would be enough to seriously injure 
or kill anyone exposed to it for several minutes, would qualify as a 
Category 1 source and would be subjected to stringent health, security, 
and use regulation. 

As noted above, the category system is focused almost exclusively 
on the source’s immediate or near-immediate effects on human health. 
Due to this discrete focus, the category system has certain significant 
limitations. In particular, it explicitly excludes: (1) any probabilities of 
harm from delayed effects of radiation - termed “stochastic effects” - 
such as radiation- induced cancer developing later in life; and (2) 


See GAO, Nuclear Security: DOE Needs Better Information to Guide Its Expanded 
Recovery of Sealed Radiological Sources, GAO-05-967, September 22, 2005 (the “GAO 
September 2005 Report”); IAEA, Code of Conduct on the Safety and Security of Radioactive 
Sources, September 8, 2003 (the “IAEA Code of Conduct”). See also IAEA, Categorization of 
Radioactive Sources, IAEA-TECDOC-I344, July 2003 (the “IAEA Categorization of 
Radioactive Sources”). 

According to the NRC Glossary, a “curie” is “[t]he basic unit used to describe the 
intensity of radioactivity in a sample of material. The curie is equal to 37 billion (3.7 x lO’®) 
disintegrations per second, which is approximately the activity of 1 gram of radium. A curie is 
also a quantity of any radionuclide that decays at a rate of 37 billion disintegrations per second. 
It is named for Marie and Pierre Curie, who discovered radium in 1898.” See 
http://www.nrc.gov/reading-nn/basic-reEulossarv/curie-ci.htm] . 

The NRC defines “stochastic effects” as “effects that occur by chance, generally 
occurring without a threshold level of dose, whose probability is proportional to the dose and 
whose severity is independent of the dose. In the context of radiation protection, the main 
stochastic effects are cancer and genetic effects.” See NRC Glossary. 
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socioeconomic consequences resulting from the dispersion of 
radioactive material. In other words, in designating the category for a 
specific source amount, the category system considers only immediate 
harm to human health, while ignoring the social and economic impacts 
of a radiological attack and the long-term health effects on a population. 

D. Materials Licenses 

The NRC and Agreement States issue licenses to allow authorized 
entities to possess and use certain radioactive materials. There are two 
types of licenses for sealed sources - general and specific. Generally- 
licensed devices are considered inherently safe because they house 
radioactive materials that are either trivial in size or embedded inside 
large and immobile machines. Generally-licensed devices, such as fixed 
gauges, luminous exit signs, and smoke detectors, require no 
authorization to purchase and use. 

Most sealed sources with industrial or medical uses, however, 
require a specific materials license. Specific licenses must be obtained 
from either the NRC or an Agreement State. Roughly 22,000 specific 
materials licenses have been issued; the Agreement States administer 
approximately 17,450 of those licenses, while the NRC administers 
approximately 4,500.'“ According to the NRC, each year the NRC 
issues about 200 new materials licenses, while the Agreement States 
issue about 800. 

To qualify for a specific materials license, an applicant must 
demonstrate that use of the radioactive material will meet safety 
requirements set forth in NRC regulations or in applicable Agreement 
State regulations. NRC offers extensive, user-friendly guidance to assist 
potential applicants in completing required paperwork (Licensing 
Guidance). In fact, NRC provides suggested answers to the questions on 
its license applications. The figure below is an excerpt of the Licensing 
Guidance illustrating how the NRC provides “Suggested Responses” - 
including specific language - to application queries. 


See GAO, Nuclear Security: Actions Taken by NRC to Strengthen Its Licensing 
Process for Sealed Radioactive Sources Are Not Effective^ GAO-07-1038T, July 12, 2007 (the 
“GAO July 2007 Report”). 
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ITEMS 7 THROUGH 11: TRAINING AND EXPERIENCE. FACILITIES 
AND EQUIPMENT, RADIATION SAFETY PROGRAM, AND WASTE 
DISPOSAL 



Sui^estcil Response 

Yes 

Alternative 

Procedures 

Attached 

7. INDIVrDUAL(S) 
RESPONSIBLE FOR 
RADIATION SAFETY 
PROGRAM AND THEIR 
TRAINING AND 
EXPERIENCE - 
RADIATION SAFETY 
OFFICER 

Name: , , 

Before obtaining materials, the 

proposed RSO will have suecessfully 
completed orteof the training courses 
described in Crfteria in the section entitled 
•iridividuaKs) Re^xmsible for Radiation 

Safety Pro^m and Their Training and 
Experience — Radiatit^ Safety Officer” in 
NUREG-i556,Vo!. 1, Rev. 1. dated 

November 2001. 

□ 

0 

8 TRAINING FOR 

INDIVIDUALS WORKING 
IN OR FREQUENTING 
RltSTRIC TED AREAS 

Before using licensed materials, authorized 
users will have successfully completed one of 
the training course described in Criteria in the 
section entitled “Training for Individuals 
Working In or Frequenting Restricted Areas" 
in NUREG<1556. Voi. 1. Rev I, dated 
: November 200 1 . 

O 
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If the application meets approval criteria, a license will be issued. 
Once a license is issued, NRC policy requires that all new licensees be 
inspected within one year, regardless of the category of the source or 
other materials being used.'^ One NRC official stated that Agreement 
States generally have the same requirement. 

E. The GAO Report In 2003 

In August 2003, the GAO released a report, entitled Nuclear 
Security: Federal and State Action Needed to Improve Security of Sealed 
Radioactive Sources, that examined numerous issues related to the 
security of sealed sources of radioactive materials. In particular, the 
GAO study focused on “( I ) the number of sealed sources in the United 
States, (2) the number of sealed sources lost, stolen, or abandoned, (3) 
the effectiveness of Federal and State controls over sealed sources, and 
(4) the [NRC] and State efforts since September 11, 2001, to strengthen 
security of sealed sources.”'*’ 

The report expressed alarm at an NRC licensing process that 
“leaves sealed sources vulnerable” by “failing to establish the 
authenticity of the prospective licensee and whether information 


' ^ See NRC, Inspection Manual, Chapter 2800, November 25, 2003, 
See GAO August 2003 Report. 
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provided in the application is indeed valid.”” The report contrasted the 
NRC’s procedures to those of several Agreement States that required the 
physical inspection of a licensee’s facilities prior to the issuance of a 
license. Importantly, the 2003 GAO report recommended that the NRC 
modify its licensing procedures “to ensure that sealed sources cannot be 
purchased before NRC’s verifieation - through inspection or other 
means - that the materials will be used as intended.”'* 

F. NRC INSPECTOR General Reports In 2006 And 2007 

In 2006, the Inspector General of the NRC (the “NRC-IG”) 
examined the NRC’s regulation of source materials, and concluded that 
NRC officials were not aware of all the potential security gaps in the 
materials license application and review process.'" Reiterating this point 
in a 2007 report, the NRC-IG asserted that “this lack of awareness was 
attributed to NRC’s failure to take a comprehensive look inwards at its 
own business and regulatory processes, which would include conducting 
vulnerability assessments of the license application and review process. 
As a result, individuals with malevolent intentions could exploit 
vulnerabilities in the license application and review process to obtain 
byproduct material for use in a dirty bomb.”“ 

The March 2006 NRC-IG report recommended that the NRC (1) 
conduct a complete vulnerability assessment of its materials program, 
including the license application and review process and the methods 
used by licensees to purchase source materials from suppliers; and (2) 
modify the license application and review process to mitigate the risks 
identified in the vulnerability assessment.^' 

G. The Subcommittee Investigation and Hearing in 2006 

In conjunction with its ongoing investigation into nuclear and 
radiological threats to the United States, the Subcommittee requested in 
2005 that the GAO probe certain vulnerabilities in NRC licensing 
procedures.^ Pursuant to the Subcommittee’s request, GAO 
investigators conducted a clandestine operation in which they purchased, 
via telephone, a small quantity of radioactive source material from a 


19 

See NRC Office of the Inspector General, Audit of the NRC Byproduct Materials 
License Application and Review Process, OIG-06-A-1 1, March 10, 2006 (the “NRC Inspector 
General March 2006 Report”). 

See NRC Inspector General March 2007 Report. 

See NRC Inspector General March 2006 Rqport. 

See GAO Testimony, Border Security: Investigators Transported Radioactive Sources 
Across Our Nation 's Borders at Two Locations, GAO-06-583T, March 28, 2006, hearing before 
the U. S. Senate Permanent Subcommittee on Investigations, S. Hrg. 109-548. 
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commercial source by posing as employees of a fictitious company. 
Then, using commercial, off-the-shelf computer software, they created 
NRC licenses modeled after official documents found on the Internet. 
Two GAO teams then used the fraudulent NRC licenses to smuggle the 
radioactive materials into the United States in two simultaneous border 
crossings. The Subcommittee held a hearing on the GAO investigation 
in March 2006. 

Although the radioactive material was detected at the borders. 
Customs and Border Protection officers at these sites failed to recognize 
the phony licenses and had no mechanism to determine whether the 
proffered licenses were in fact valid. Therefore, even though the 
Customs officials at the borders largely followed proper procedures in 
stopping the GAO vehicles, they permitted the GAO teams to enter the 
country with their cargo. 

In late March, 2006, the Subcommittee held a two-day hearing 
called Neutralizing the Nuclear and Radiological Threat: Securing the 
Global Supply Chain. At that hearing. Senator Norm Coleman, then- 
Chairman of the Subcommittee, inquired about the implementation of an 
NRC materials license database and explored possible measures to 
confirm applicant validity, urging the NRC to “reform the processes by 
which anyone can acquire radiological material.”^’ The NRC 
subsequently established a system enabling U.S. border personnel to 
quickly verify the authenticity of NRC licenses presented at the border. 

H. NRC AMENDS Its Licensing Procedures In December 2006 

In response to recommendations from the GAO, the NRC-IG, and 
the Subcommittee, the NRC amended its materials licensing procedures 
in December 2006. Specifically, the NRC adopted a program to assist 
NRC reviewers in assessing materials license applications.^^ The revised 
process was entitled “Checklist to Ensure that Radioactive Materials 
Will Be Used as Intended” (Checklist). 

The Checklist prompts NRC reviewers to make two threshold 
determinations - namely, whether the applicant is unknown to the 
reviewer and has not previously received a materials license; and 
whether the application seeks authorization for Category 1 or 2 sources - 
i.e., the most dangerous radioactive materials. There is no scmtiny if the 
answer to both threshold questions is “No” - i.e., the applicant is known 
and the requested license is for sources in Category 3 or below. In such 


23 

See littp://wvvw.hseac.senate.gov/mdex.cfm?Fuscaction=Hearings.DetaiI&HearingID=336 and 
http:// w\v'w.hsgac.senate.gov/index.cfm?Fuseaction=HearinKs.Dctail&HcaringID=^335 . 

24 

See NRC, The NRC Source Data Team and U.S. Customs, www. nrc. go v/securitv/ 
bvproduct/export-import/soiirce-data-team.html . 

25 

See NRC, Checklist to Ensure that Radioactive Materials Will Be Used as Intended, 
December 2006. 
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circumstances, the review process basically ends and a license will 
generally be issued. In fact, the Checklist plainly instructs reviewers 
that, if the answer to either threshold question is “No,” “then do not 
complete Step 2. Sign and date the completed form 

If the answer to either question is “Yes” - i.e., the applicant is 
unknown or the application requests materials in Categories 1 or 2 - 
reviewers are prompted to proceed to Step 2, which gives guidance to 
the reviewer regarding further scrutiny of the application. For instance, 
the guidance suggests requesting supplemental information concerning 
the ownership of the applicant and the authority and training of the 
applicant’s Radiation Safety Officer. As noted above, the NRC provides 
Licensing Guidance to applicants on how to respond to NRC queries, 
including offering suggested responses to specific questions.^’ 

In addition to the information requests, the Checklist provides 
guidance on whether a visit to the applicant’s facilities is required. The 
guidance requires a physical inspection for applications for Category 1 
and 2 sources before a license is issued. For applications for Category 3 
or 4 sources, however, the physical inspection requirement is 
considerably more lenient. Pursuant to the Checklist, a license for 
Category 3 sources or below may be issued before an on-site visit. The 
on-site visit may take place up to 12 months after the license has been 
issued. In contrast to the NRC procedures for post-issuance visits, 
several Agreement States conduct an on-site visit before the issuance of 
a license to verify the legitimacy of potential licensees.^* According to 
GAO, several Agreement States either inspect facilities before a license 
is issued or hand-deliver the licenses in order to observe the applicant’s 
facilities.^’ 

IV. THE 2007 INVESTIGATION 

Building on its previous review of NRC licensing procedures, the 
Subcommittee asked GAO in October 2006 to test whether the NRC’s 
revised licensing procedures were effective. The facts surrounding the 
GAO’s efforts are recounted in detail in GAO’s testimony before the 
Subcommittee, entitled Actions Taken by NRC to Strengthen Its 
Licensing Process for Sealed Radioactive Sources Are Not Effective f 
Below is a brief review of the GAO’s 2007 operation and its 
recommendations. 


See id. 

See NRC, Consolidated Guidance About Materials Licenses: Program-Specific 
Guidance About Portable Gauge Licenses., NUREG-1556, Vol. 1, November 2001. 

See GAO August 2003 Rqiort. 

See id. 

“ See GAO July 2007 Report. 
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A. Obtaining A Real NRC License For A Fake Company 

Pursuant to the Subcommittee’s October 2006 request, GAO 
investigators incorporated two dummy corporations in Delaware in the 
fall of 2006. These two companies had no capitalization, no operations, 
no websites, no physical 
facilities, and no 
employees. Using aliases 
and the names of the 
bogus corporations, GAO 
investigators applied for 
two materials licenses - 
one from the NRC and 
one from an Agreement 
State. They requested a 
license to obtain 
specified low quantities 
of Category 4 materials. 

The differences between 
the two results could not 
be more stark. 

Shortly after the 
GAO submitted its 
application to the 
materials licensing agency in the Agreement State, the agency sent a 
letter to the GAO’s dummy “company,” indicating that GAO’s 
application was incomplete; “During the Department’s review of your 
application dated February 12, 2007, deficiencies were found.” The 
Agreement State sought additional information regarding company 
personnel, the Radiation Safety Officer’s authority to stop unsafe 
operations, and disposal procedures. The GAO indicated that regulators 
also insisted on interviews, physical inspections, and tours of the non- 
existent company’s facilities. In total, the Agreement State licensing 
agency indicated that the process would take roughly 7 months. In light 
of the rigorous application process - in particular, the required physical 
inspection of the applicant’s facilities - GAO elected to withdraw its 
application. 

The application to the NRC, in contrast, was subjected to very little 
scrutiny. According to GAO’s testimony, the NRC exchanged a couple 
of faxes and phone calls with the “company executive.” Satisfied with 
that cursory review, the NRC mailed the materials license to the 
company’s “headquarters,” which was a drop-box at a retail UPS 
location. From the date of application to the issuance of the license, the 
entire process lasted 28 days. GAO investigators essentially obtained a 
valid materials license from the NRC without ever leaving their desks. 
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PARISO 
CONDI) 
ND AGR 


NRC 


Agreement State 


Physical 

Inspection? 


As noted above, the State regulator informed the GAO investigators, who were acting 
in a clandestine manner, that the licensing process would take 7 months and that it required a 
physical inspection of the applicant’s facilities. In light of the exhaustive nature of the 
impending review, GAO investigators elected to withdraw the application to that State on behalf 
of the phony entity. In other words, a site visit was requested by the State agency, but no actual 
inspection occurred. 
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B. Counterfeiting The NRC License 

After receiving the valid NRC license, GAO investigators then 
counterfeited it. Using off-the-shelf computer software, they scanned 
the license into a computer, created multiple facsimiles to purchase 
radioactive material, and removed the limits on the quantities of source 
materials authorized to be purchased. Redacted copies of the authentic 
NRC license and one of the counterfeited GAO documents are 
reproduced below. The key difference between the two documents is in 
Sections 8(A) and 8(B), in which the maximum amounts in the valid 
license are removed in the counterfeited version. 
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After altering the quantity of allowable source material, GAO 
investigators contracted with two different companies to purchase a 
significant number of portable moisture density gauges.^ Those gauges, 
in the aggregate, contain an amount of americium-241 and cesium-137 
that is vastly in excess of the amount authorized on the original NRC 
license. The aggregate amount of radioactive materials that the GAO 
contracted to buy would meet the NRC’s definition of a “dangerous” 
quantity and would be sufficient to construct a dirty bomb. 

Even though the amount of radioactive materials would have been 
sufficient for a dirty bomb, the amount of the radioactive materials 
sought in the GAO operation is actually understated. Investigators 
indicated that they could have easily prolonged their effort, generating 
dozens of fake licenses, visiting multiple suppliers, and stockpiling 
significantly higher amounts of this (and potentially more radioactive) 
material. The GAO states that it could have purchased “substantially 
more radioactive source material,” possibly enough to reach the 
threshold of a “very dangerous” quantity. In other words, the modest 
amount of radioactive materials that GAO sought to purchase was but a 
demonstration amount, and it could have been considerably larger. 

In conjunction with its clandestine operation, the GAO made the 
following recommendations to the NRC: 

1. The NRC needs to “develop improved guidance for 
examining NRC license applications [in order] to provide 
reasonable assurance that licenses for radioactive materials 
will only be issued to those with legitimate uses.” 

2. The NRC should conduct “periodic oversight of license 
application examiners so that the NRC will be assured that 
any new guidance is being appropriately applied.” 

3. The NRC should “explore options to prevent individuals 
from counterfeiting NRC licenses, especially if this allows 
the purchase of more radioactive materials than they are 
approved for under the terms of the original license.” 

C. Following The 2007 Investigation, NRC Revises Its 
Licensing Process 

Several months ago, GAO informed the NRC of its most recent 
operation. Shortly thereafter, the NRC temporarily halted its licensing 
process and revised its licensing procedures. In particular, the NRC 
issued a Supplemental Interim Guidance to address “a recently identified 
gap in NRC’s pre-license guidance” (Interim Guidance). “ The principal 


32 

GAO declined to take actual possession of the radioactive materials. 

See NRC, Supplemental Interim Guidance for Checklist to Ensure that Radioactive 
Materials Will Be Used as Intended, NUREG-1556, Volume 20, Appendix C, June 12, 2007. 
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change reflected in the Interim Guidance is a modest increase in the 
scrutiny of new applications for specific licenses for Categories 3 and 4 
sources. Before June 2007, no site visits were required for Category 3 or 
4 applicants before a license was issued and the first visit to a licensed 
facility could occur up to 12 months after license issuance. The Interim 
Guidance changes that process and requires that reviewers conduct pre- 
licensing “visits” with applicants:^" 

[T]his supplemental interim guidance now 
requires that alt applications for a new license will 
have a pre-licensing visit or meeting. The 
purpose of this visit is to verify the information 
provided by the applicant to assure that the 
radioactive materials will be used as intended.^^ 

To be clear, however, the Interim Guidance does not necessarily 
require that the reviewer’s “visit” include a physical inspection of an 
applicant’s facilities.^'^ Instead, a reviewer may satisfy the “visit” 
requirement by meeting with an agent of the applicant in an NRC 
office.” 

V. RECOMMENDATIONS 

A. The NRC Should Reevaluate The Apparent Good-Faith 
Presumption That pervades Its Licensing Process, 

An examination of the NRC’s administration of materials licensing 
reveals one paramount theme: the NRC licensing procedures appear to 
assume that all applicants are acting in good faith and do not harbor 
malicious motives. Indeed, it appears that there is an insufficient degree 
of institutional skepticism and, therefore, little in the way of a true 
screening process. For instance, as described above, the NRC’s 
Licensing Guidance spoon-feeds applicants with model language and 
stock responses to application queries in order to streamline the 
licensing process. Summarizing the licensing process, one GAO 
investigator stated, “It’s a paperwork process asking for boilerplate.” 

Another sign of the NRC’s assumption of good faith is that 
physical inspection of an applicant’s facilities can occur up to one year 
after a license has been issued. GAO highlighted this very concern in 
2003: 


See id. 
See id. 
See id. 
See id. 
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[W]e found a potential security weakness in 
NRC’s licensing process to obtain sealed sources. 

The process assumes an applicant is acting in 
good faith and allows applicants to acquire sealed 
sources as soon as a new license is issued by mail. 

It can then take NRC as long as 12 months to 
conduct its first inspection, leaving the possibility 
that materials will be obtained and used 
maliciously in the meantime.^® 

Similarly, the NRC-IG found that the NRC’s adoption of the IAEA 
category system (which, as noted above, excludes important categories 
of harm) does not sufficiently account for potential bad actors, such as 
terrorists: “By its very definition, such an approach would discount the 
intentions and capabilities of a malevolent entity bent on obtaining 
byproduct material that could be used in a dirty bomb.”^’ 

The NRC has shown a willingness to consider these concerns. For 
instance, as noted above, it recently revised its licensing procedures to 
require a physical inspection or at least a face-to-face meeting before the 
issuance of a materials license. More steps, however, are needed. 

B. The NRC Should Regulate Category 3 Sources More 
Stringently. 

NRC licensing procedures governing Category 3 sources are not 
sufficiently rigorous. Category 3 sources deserve more stringent 
regulation because they are more dangerous than the current category 
regime suggests. As noted above, the NRC’s category system is based 
on the IAEA Code of Conduct."'® That scale is based almost exclusively 
on one narrow category of harm: the immediate or near-immediate 
effects on human health. The system expressly excludes from its 
categorization criteria both (1) any probabilities of harm from delayed 
effects of radiation - termed “stochastic effects” - such as radiation- 
induced cancer developing later in life;"" and (2) socioeconomic 
consequences resulting from the dispersion of radioactive material. 
Excluding those important categories of harm underestimates the 
potential impact of the dispersal of a Category 3 source. 

The NRC-IG articulates that very conclusion in a 2007 report, 
concluding that the “NRC policy for evaluating the risks of dirty bombs 


See id. 

30 

See NRC Inspector General 2007 Report. 

4f) 

See GAO September 2005 Report, IAEA Code of Conduct and IAEA Categorization 
of Radioactive Sources. 

"" See id. 
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. . . does not recognize all of the potential effects of a dirty bomb.”''" The 
IG report lamented that the NRC policy took into account only “prompt 
fatalities.” The report also stated: 

When questioned by Government auditors or 
elected officials about the bases of its security- 
related actions or about its efforts to identify and 
close vulnerabilities in its material licensing and 
tracking programs, NRC has consistently pointed 
to a “graded, risk-informed” approach to 
byproduct material security. For NRC, the 
“graded, risk-informed” approach results in the 
identification of “risk-significant” or “highrisk” 
sources, equivalent to IAEA Category 1 and 2 
sources. NRC’s “graded, risk-informed” 
approach discounts factors related to malevolent 
terrorist intentions because the agency focuses the 
performance of its mission — including those 
related to common defense and security — to 
scientific and engineering evaluations of licensed 
activities that use radioactive material. Indeed, 
the agency notified the House Committee on 
Government Reform that factors — such as 
psychological, social, and economic effects— can 
vary and provide a less stable measure for 
establishing security measures. By its very 
definition, such an approach would discount the 
intentions and capabilities of a malevolent entity 
bent on obtaining byproduct material that could be 
used in a dirty bomb.''^ 

The IG report also stated that “measuring dirty bomb consequences 
without consideration of these additional consequences [i.e., technical, 
socioeconomic, psychological, environmental and other effects] causes 
the NRC to understate the risk these weapons pose to national 
security.”'''' 

There is currently no mechanism to prevent malevolent actors from 
stockpiling numerous lower-risk sources well beyond the limits 


See NRC Inspector General 2007 Report. 

See NRC Inspector General 2007 Report, Notably, the Inspector General has 
questioned the efficacy of NRC’s “risk-informed” categorization regime, noting that “although 
the staff states that the approach is risk-informed, OIG has not been presented with any 
documentary evidence of a risk assessment.” See NRC Office of the Inspector General, Audit 
Report - Audit of the Development of the National Source Tracking System, OIG-06-A-10, 
February 23, 2006 (the “NRC Inspector General Feb. 2006 Report”). 

'''' See id. 
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authorized in the license. This methodical aggregation could allow a 
terrorist to “fly beneath the radar” and avoid regulation and detection 
while accumulating more and more source material. This report offers 
recommendations regarding a web-based licensing system that would 
minimize this risk. 

Considering that the categorization system does not address the 
full scope of the impact of radioactive dispersal and that there is no 
mechanism to prevent aggregation of lower-risk sources, the NRC 
should subject Category 3 sources to heightened scrutiny. In particular, 
the NRC should regulate Category 3 sources more carefully by (1) 
requiring an on-site visit before a Category 3 license is issued and (2) 
considering incorporating Category 3 sources into the National Source 
Tracking System. 

1 . The NRC Should Physically Inspect Applicants’ Facilities 
Before The Issuance Of A Category 3 Materials License. 

As noted above, under the current category system, applications 
for Categories 1 and 2 sources receive substantially heightened scrutiny 
from NRC reviewers. Category 3 sources should be similarly regulated. 
For instance, at the time of the GAO’s 2007 operation, the NRC did not 
require physical inspection of licensee facilities prior to the issuance of 
licenses for Category 3 sources; the only on-site visit would generally 
take place during the 12-month period after issuance of a license. In 
contrast, many Agreement States verify the legitimacy of potential 
licensees via either pre-licensing inspection or hand delivery of the 
licenses. This is a crucial difference, since a licensee can make 
purchases as soon as a license is received in the mail - i.e, before the 
NRC has verified the legitimacy of the applicant. 

To its credit, the NRC’s recently-issued Interim Guidance makes 
strides in the direction of mandatory inspections of facilities seeking 
licenses. Specifically, it requires NRC reviewers to visit with applicants 
face-to-face before the issuance of a license. That Interim Guidance, 
however, contains a significant loophole - namely, that “all applications 
for a new license will have a pre-licensing visit or meeting.”*^ 
Therefore, the “visit” requirement could be satisfied without an on-site 
physical inspection of an applicant’s facilities but rather an in-person 
interview at NRC offices. For applications involving Category 3 sources 
and above, the standard procedure - perhaps allowing for rare 
exceptions - should require an on-site physical inspection of an 
applicant’s facilities before the issuance of a license. 


45 

See NRC Supplemental Interim Guidance (emphasis added). 
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2 . The NRC Should Consider Including Category 3 Sources in 
the Proposed National Source Tracking System. 

Under the current regulatory regime, NRC licensees are not 
required to report radioactive material inventories to NRC. As a result, 
there is no mechanism for the government to track radioactive materials 
from cradle to grave - i.e., the manufacture, transport, receipt, 
disassembly, and disposal of sealed sources. Without such a tracking 
mechanism, radioactive sources can end up anywhere from landfills to 
terrorist cells. 

Recognizing the importance of tracking certain source materials, 
the Department of Energy (DOE) and NRC established an Interagency 
Working Group on RDDs in July 2002. This working group explored 
the possibility of creating a nationwide system that would track 
radioactive sources and recommended that NRC develop such a tracking 
system “to better understand and monitor the location and movement of 
certain radioactive sources. In response, the NRC adopted plans for a 
National Source Tracking System (NSTS), which would be a web-based 
system containing cradle-to-grave information on high-risk sealed 
sources. The proposed NSTS as currently planned, however, will track 
only Category 1 and 2 sources. 

The NRC-IG recently noted that the omission of Category 3 
sources from the NSTS is “another gap in the agency’s approach to 
material security.””’ Moreover, the GAO noted an inconsistency with 
the exclusion of Category 3 sources from NSTS, stating “the aggregate 
radioactivity of co-located individual sources poses enough of a safety 
and security risk to warrant their recovery by DOE, but the sources will 
not be tracked in NSTS because they are not Category 1 or 2 sources.””® 
The Health Physics Society (HPS), an independent scientific 
organization of radiation safety professionals, also noted that the NRC 
should consider including Category 3 sources in the proposed NSTS 
“because of the potential for unacceptable personal injury, economic, or 
social consequences from a mismanaged or poorly secured individual 
Category 3 source.””’ 

The HPS recommends that, because of the 
potential for unacceptable personal injury, 
economic, or social consequences from a 
mismanaged or poorly secured individual 
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See NRC Inspector Genera! Feb. 2006 Report. 

47 

See NRC Inspector General 2007 Report. 

48 

See GAO, Nuclear Security: DOE Needs Better Information to Guide Its Expanded 
Recovery of Sealed Radiological Sources, GAO-05-967, September 22, 2005. 

49 
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Category 3 source, the NRC should be consistent 
with the approach of the IAEA and consider that 
Category 3 sources warrant inclusion in the 
tracking system, unless an analysis can 
demonstrate that the large number of such sources 
and the economic cost for tracking them would be 
overly burdensome. If the analysis demonstrates 
that the inclusion of all Category 3 sources is not 
justified on an economic basis, an evaluation 
should be performed as to how aggregate 
quantities of Category 3 sources that roll up to 
Category 1 or 2 thresholds can be identified and 
included in the tracking system or to identify if 
there are alternatives other than an “all or 
nothing” approach. For example, the analysis 
might identify some types of Category 3 sources 
that could be excluded while others should 
appropriately be included in the tracking system 
or may identify alternatives to the National Source 
Tracking System that accomplish the same results 
for these sources.™ 

The issue of whether some or all Category 3 sources should be 
included in NSTS has generated significant debate within the NRC and 
in written comments submitted by Agreement States and experts. To 
date, the NRC has not decided the extent to which Category 3 sources 
will be tracked. Key concerns include the cost and logistics involved in 
tracking Category 3 materials, whether tracking those materials would 
divert attention and resources from more dangerous Category 1 and 2 
materials, and whether it would make sense to track some but not all 
Category 3 sources. The NRC should continue to work with all 
stakeholders to determine the feasibility of Category 3 inclusion and to 
conduct appropriate cost-benefit analyses. It is important, however, to 
resolve this matter in the near future so that the NSTS, already 5 years in 
the planning, can be deployed as soon as possible. 

C. The NRC Should Act Quickly To Establish A Web- 
Based Licensing System To Ensure That Source Materials 
Can Be Obtained Only In Authorized Amounts By 
Legitimate Users. 

Counterfeit NRC materials licenses were the common denominator 
of both the 2006 and 2007 GAO clandestine operations. Preventing the 
use of altered licenses remains a serious obstacle to securing radioactive 
material. Numerous witnesses interviewed by the Subcommittee 
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indicated that many companies use multiple radioactive devices 
scattered among hundreds of worksites, each of which house copies of 
the NRC materials license. Moreover, customers and suppliers are 
typically separated by great distances (sometimes thousands of miles), 
and therefore, most transactions are completed with phone calls and 
faxed copies of NRC licenses. This is why the GAO had no trouble at 
all passing counterfeit licenses off as authentic in both the 2006 and 
2007 operations - faded copies and smudged faxes are standard 
operating procedure when it comes to NRC licenses. 

In light of the fact that these licenses will inevitably be copied and 
faxed repeatedly, the solution cannot lie in simply including watermarks 
and improving defenses in the document itself Such solutions might be 
sufficient only insofar as an original license was being examined, not a 
fourth-generation fax thereof To the contrary, the answer to preventing 
the use of counterfeit licenses must lie in creating a mechanism by 
which suppliers and law enforcement officials can verify that a proffered 
license is in fact authentic. 

One such mechanism is a web-based licensing system. A web- 
based system, which is currently under development by the NRC, would 
close two glaring loopholes in the effort to reduce the unauthorized 
transfer and possession of radioactive materials. First, it would permit 
suppliers of radioactive materials to access a secure, NRC database to 
confirm, in real time, a license’s authenticity. Suppliers, law 
enforcement officials, and Federal and State regulators, using such a 
system, could confirm within minutes (1) the name of the authorized 
user; (2) the name and authorized amount of the source material; and (3) 
the type and number of devices the licensee is entitled to purchase. 

Second, a web-based system would reduce the possibility of 
aggregation - i.e., a licensee avoiding regulation by stockpiling low-risk 
radioactive material by repeatedly purchasing the maximum allowable 
amount from multiple suppliers. In other words, such a system would 
enable suppliers and regulators alike to track a licensee’s purchases and 
confirm - again, in real time - whether the licensee has already met or 
exceeded the license’s maximum allowable amount. 

VI. CONCLUSION 

The recommendations in this report are designed to bolster our 
government’s efforts to prevent a radiological attack in the United 
States. It is clear that terrorists are interested in using a dirty bomb to 
wreak havoc in this country. In the words of one homeland security 
expert, the impact of such an attack - even a relatively simple and small 
dirty bomb - could be a “nightmare scenario.”^' As a result, the 
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government must be more vigilant in regulating and tracking radioactive 
materials in the United States. One critical step is to prevent America’s 
enemies from acquiring radioactive materials in the first place. To that 
end, the NRC should focus on ensuring that such materials can be 
obtained only in authorized amounts by legitimate users. These 
measures will help ensure that the “nightmare scenario” of a dirty bomb 
attack never occurs. 

♦ ♦ ♦ 


Bush, quoted in Jon Fox, Global Security Newswire, ^'‘'Diriy Bomb' Could Be Disastrous, 
NYPD Ojjicial Says," June 13, 2007. 
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RESPONSES TO SUPPLEMENTAL QUESTION FOR THE RECORD 

FROM 

SENATOR DANIEL K. AKAKA 

to 

THE HONORABLE EDWARD McGAFFIGAN, JR. 

Commissioner 

Nuclear Regulatory Conunission 


PERMANENT SUBCOMMITTEE ON INVESTIGATIONS 
HEARING ON 


DIRTY BOMB VULNERABILITIES: 

FAKE COMPANIES, FAKE LICENSES, REAL CONSEQUENCES 

July 12, 2007 


1. In Mr. Kutz’s testimony before the Subcommittee, he stated that suppliers of machines that 
contained radioactive sources believe that it is not their job to ensure the validity of NRC 
licenses. He added that the establishment of a sveb-based system would assist suppliers in 
verifying the bona fides of licensees before orders were filled. 

I am not confident that this will address the problem. Supplier companies should ensure 
that the licensees they supply are legitimate as part of their corporate responsibility. There 
are a number of companies that provide controlled technologies in the nuclear field that 
have taken it upon themselves to report suspicious requests to the relevant authorities. 

In pursuit of a “layered defense” against theft and misuse of radioactive material, what is 
the NRC is doing or could do to assist suppliers in developing such behavior? 

RESPONSE : We acknowledge that the verification process can be improved and 
NRC staff is preparing a comprehensive integrated action plan to identify potential 
vulnerabilities and to develop solutions for NRC and Agreement States materials 
licensing programs. This plan will include a combination of short and long term 
actions to improve the national materials licensing program, including possible future 
enhancements to the regulations. Web-Based-Licensing will be an important 
component of these actions. 

NRC and the Agreement States use Information Notices (IN), among other means, 
to communicate to its licensees and to raise awareness when current events warrant 
For example, on July 6, 2006 NRC issued an IN to all material licensees to 
emphasize that due diligence should be exercised before and during transfer of 
radioactive material. This IN alerted licensees to exercise extra caution to assure that 
only legitimate, licensed entities are on the receiving end of the transfer of the 
licensed material. NRC is preparing to issue another IN to all materials licensees to 
heighten their sensitivity to the vulnerability in our licensing process identified by 
GAO. 

I permanent Subcommittee on Investigations 
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I would also call your attention to letters sent after the hearing by the largest 
manufacturer of moisture-density gauges - Troxler Electronic Laboratories, 
Incorporated - to the subcommittee and the NRC. Mr, William F. Troxler, Jr., the 
company chairman and president, indicates that his company was not fooled by the 
GAO sting, and would not have supplied the gauges to the fake GAO company. In 
his letter to NRC, Mr. Troxler also makes several suggestions for improved controls 
which have arisen from his conversations with North Carolina regulators. The NRC 
staff will evaluate his and North Carolina’s suggestions in developing NRC’s action 
plan. 


2. During the hearing, Mr. Cooney of GAO stated that, had he met with NRC licensing 
reviewers directly prior to issuance of the license for the fake company, he would have been 
able to fool them into believing that the company and the license request were legitimate. 
This makes me concerned about the skills that NRC license reviewers have. The 
procedures NRC has in place for reviewers to ensure that companies requesting licenses 
seems not to be effective, as was shown in the GAO investigation. 

Can you tell me what the NRC is doing to better train license reviewers to detect bogus 
requests from illegitimate companies? 

RESPONSE : In response to the GAO investigation, NRC temporarily stopped 
issuing licenses, and developed and issued a supplemental procedure that now 
requires pre- licensing visits or Regional office meetings for essentially all applicants. 

All license reviewers are aware of the new guidance for license application reviews. 

The increased use of site visits before issuing new licenses is part of the revised 
license review procedure. The exception to performing a pre-licensing site visit is 
when an application for a new license is received from an existing licensee that is in 
good standing. The reviewer must be confident from previously established licensing 
and inspection experience and knowledge of the licensee, that the material will be 
used for its intended purpose. 

To ensure a comprehensive long-term solution is reached, NRC has worked with the 
Agreement States to re-establish the Pre-License Guidance Working Group which 
will re-evaluate the guidance issued in December 2006 and the recent June 2007 
supplemental guidance and procedure, and will address the issues uncovered by the 
GAO investigation. Through Regional training sessions, NRC will assure that its 
license reviewers are thoroughly familiar with the guidance developed by this group. 
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